{"id":4235,"date":"2026-11-05T07:21:00","date_gmt":"2026-11-05T07:21:00","guid":{"rendered":"https:\/\/www.ucartz.com\/blog\/what-is-dnssec\/"},"modified":"2026-11-09T22:05:05","modified_gmt":"2026-11-09T22:05:05","slug":"what-is-dnssec","status":"publish","type":"post","link":"https:\/\/www.ucartz.com\/blog\/what-is-dnssec\/","title":{"rendered":"What Is DNSSEC? How It Works and How to Check It"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">DNSSEC (DNS Security Extensions) adds digital signatures to DNS records so a resolver can check that an answer really came from the domain&#8217;s DNS servers and was not changed on the way. It protects against forged DNS answers, such as cache poisoning that sends visitors to a fake server. It does not encrypt anything and does not stop DDoS attacks. To use it, your DNS host signs your zone, and you add a DS record at your domain registrar. You can check any domain with <code>dig<\/code> or <code>delv<\/code> in a few seconds.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"256\" src=\"https:\/\/www.ucartz.com\/blog\/wp-content\/uploads\/2026\/11\/what-is-dnssec-screenshot-1024x256.png\" alt=\"Terminal showing a DS record, the ad flag in dig output and a SERVFAIL for dnssec-failed.org\" class=\"wp-image-4249\" srcset=\"https:\/\/www.ucartz.com\/blog\/wp-content\/uploads\/2026\/11\/what-is-dnssec-screenshot-1024x256.png 1024w, https:\/\/www.ucartz.com\/blog\/wp-content\/uploads\/2026\/11\/what-is-dnssec-screenshot-300x75.png 300w, https:\/\/www.ucartz.com\/blog\/wp-content\/uploads\/2026\/11\/what-is-dnssec-screenshot-768x192.png 768w, https:\/\/www.ucartz.com\/blog\/wp-content\/uploads\/2026\/11\/what-is-dnssec-screenshot.png 1100w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">DNSSEC in practice: the DS record of isc.org, the ad (authenticated data) flag from a validating resolver, and SERVFAIL for a domain with broken DNSSEC<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">What DNSSEC does, and what it does not<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Plain DNS has no way to prove an answer is genuine, so a resolver cannot tell a forged reply from a real one. DNSSEC fixes that. According to <a href=\"https:\/\/www.rfc-editor.org\/rfc\/rfc4033\" target=\"_blank\" rel=\"noopener noreferrer\">RFC 4033<\/a>, the extensions provide origin authentication and integrity for DNS data, including a signed way to prove that a name does not exist. The same RFC is clear about the limits:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>No confidentiality.<\/strong> DNSSEC was never designed to hide queries. Anyone on the path can still see which names you look up. Encrypted transports such as DNS over TLS or HTTPS solve a different problem.<\/li>\n\n\n\n<li><strong>No DDoS protection.<\/strong> RFC 4033 says DNSSEC provides no protection against denial of service attacks, and signed servers face extra load from cryptographic work.<\/li>\n\n\n\n<li><strong>No protection after the answer.<\/strong> DNSSEC proves the IP address is the one the domain owner published. HTTPS still has to protect the connection to that address.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">How DNSSEC works: the chain of trust<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">DNSSEC is defined mainly in RFCs 4033, 4034 and 4035, with NSEC3 added in RFC 5155; <a href=\"https:\/\/www.rfc-editor.org\/rfc\/rfc9364\" target=\"_blank\" rel=\"noopener noreferrer\">RFC 9364<\/a> gives the overview. It adds a few record types:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Record<\/th><th>Where it lives<\/th><th>What it does<\/th><\/tr><\/thead><tbody><tr><td>DNSKEY<\/td><td>Your zone<\/td><td>Publishes the public keys used to sign the zone<\/td><\/tr><tr><td>RRSIG<\/td><td>Your zone<\/td><td>A signature for each set of records (A, MX, TXT and so on)<\/td><\/tr><tr><td>DS<\/td><td>The parent zone, such as .com, set through your registrar<\/td><td>A hash of your key, which links your zone to the parent<\/td><\/tr><tr><td>NSEC or NSEC3<\/td><td>Your zone<\/td><td>Signed proof that a name or record type does not exist<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">A validating resolver checks the RRSIG on your A record with your DNSKEY. It trusts your DNSKEY because the DS record in the .com zone matches it. It trusts the .com zone because the root zone holds a DS for .com, and it trusts the root because it is configured with the root zone&#8217;s key, the trust anchor. That is the chain of trust. If any link is missing, the domain is simply unsigned. If a link is wrong, validation fails and the resolver refuses to answer.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to check if a domain has DNSSEC<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We ran these checks from a Debian 13 container with the BIND 9.20.29 tools (<code>apt install bind9-dnsutils<\/code>). We added <code>@1.1.1.1<\/code> to each command to query a public validating resolver; without it, the tools use the resolver your system is set to.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. Look for a DS record<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>$ dig +short DS isc.org\n7250 13 2 A30B3F78B6DDE9A4A9A2AD0C805518B4F49EC62E7D3F4531D33DE697 CDA01CB2<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A DS record in the parent means DNSSEC is switched on for the domain. The fields are the key tag (7250), the algorithm (13, which is ECDSA P-256 with SHA-256) and the digest type (2, SHA-256). No output means the domain is not signed.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. Ask for signatures and look for the ad flag<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>$ dig +dnssec isc.org A\n;; flags: qr rd ra ad; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1\n...\nisc.org.   300  IN  A      151.101.3.42\nisc.org.   300  IN  RRSIG  A 13 2 300 20261007083945 20260923082238 27566 isc.org. OXvaMtH9...<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The RRSIG line is the signature, with its expiry and start times. The <code>ad<\/code> (authenticated data) flag means the resolver validated the answer. An unsigned domain returns the same query with no RRSIG and no <code>ad<\/code> flag. The <code>ad<\/code> flag is only as trustworthy as the resolver you asked, so for a proper test, validate locally.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Validate it yourself with delv<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>$ delv isc.org A\n; fully validated\nisc.org.   300  IN  A      151.101.3.42\n...<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>delv<\/code> does the validation itself. Its manual says it validates using a built-in trust anchor for the root zone, so it does not depend on the resolver&#8217;s <code>ad<\/code> flag. &#8220;fully validated&#8221; is the answer you want; for <code>wikipedia.org<\/code>, which is not signed, <code>delv<\/code> printed &#8220;; unsigned answer&#8221;.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What a broken DNSSEC domain looks like<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><code>dnssec-failed.org<\/code> is kept deliberately broken for testing. Its DS record does not match its keys:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ dig dnssec-failed.org A\n;; -&gt;&gt;HEADER&lt;&lt;- opcode: QUERY, status: SERVFAIL, id: 22145\n; EDE: 9 (DNSKEY Missing): (no SEP matching the DS found for dnssec-failed.org.)\n\n$ dig +cd dnssec-failed.org A\n;; -&gt;&gt;HEADER&lt;&lt;- opcode: QUERY, status: NOERROR, id: 38252\ndnssec-failed.org.  300  IN  A  96.99.227.255\n\n$ delv dnssec-failed.org A\n;; resolution failed: failure<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This is the important lesson. A validating resolver answers <strong>SERVFAIL<\/strong>, so for its users the site and its email simply stop working. The <code>+cd<\/code> (checking disabled) flag proves the records exist and the problem is the signatures. The extended error (EDE) line tells you why. If your own domain ever shows SERVFAIL on some networks but works with <code>+cd<\/code>, look at DNSSEC first.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Which port does DNSSEC use?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The same as ordinary DNS: port 53, over UDP and TCP. There is no separate DNSSEC port. What changes is the size of the answers. <a href=\"https:\/\/www.rfc-editor.org\/rfc\/rfc7766\" target=\"_blank\" rel=\"noopener noreferrer\">RFC 7766<\/a> notes that DNSSEC has increased response sizes, that signed responses routinely exceed 1,500 bytes, and it makes TCP support a requirement for DNS software. So if you run your own name server, allow <strong>both<\/strong> UDP and TCP port 53 in the firewall. If TCP 53 is blocked, signed answers too large for UDP cannot be fetched at all.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to enable DNSSEC for your domain<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Two parties are involved: whoever hosts your DNS zone (the name servers your domain uses) and your registrar. The steps are always the same:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Sign the zone at your DNS host.<\/strong> This creates the DNSKEY and RRSIG records and gives you the DS details: key tag, algorithm, digest type and digest.<\/li>\n\n\n\n<li><strong>Add the DS record at your registrar<\/strong>, in the domain&#8217;s DNSSEC or DS settings. Some DNS hosts do this for you when they are also the registrar.<\/li>\n\n\n\n<li><strong>Wait and test<\/strong> with <code>dig DS<\/code> and <code>delv<\/code> as above.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Where to click depends on the DNS host:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Cloudflare DNS.<\/strong> According to <a href=\"https:\/\/developers.cloudflare.com\/dns\/dnssec\/\" target=\"_blank\" rel=\"noopener noreferrer\">Cloudflare&#8217;s DNSSEC documentation<\/a>, you enable DNSSEC in the DNS settings, then add the DS record it shows at your registrar. Cloudflare adds the DS itself only for domains registered with Cloudflare and for .ch and .cz. It prefers algorithm 13, the same ECDSA algorithm as in the examples above.<\/li>\n\n\n\n<li><strong>cPanel servers.<\/strong> The <a href=\"https:\/\/docs.cpanel.net\/knowledge-base\/dns\/dnssec\/\" target=\"_blank\" rel=\"noopener noreferrer\">cPanel DNSSEC documentation<\/a> says the server must use PowerDNS as its nameserver. The administrator enables the Manage DNSSEC feature in WHM&#8217;s Feature Manager, and users create keys in <strong>cPanel \u00bb Domains \u00bb Zone Editor<\/strong>. Switching a cPanel server to PowerDNS is covered in <a href=\"https:\/\/www.ucartz.com\/clients\/knowledgebase\/1845\/Installing-PowerDNS-through-Name-Server-Selection.html\">Installing PowerDNS through Name Server Selection<\/a>.<\/li>\n\n\n\n<li><strong>Your own BIND server.<\/strong> BIND 9.20 can sign and maintain a zone with one line. We tested this zone definition:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>zone \"example.test\" {\n    type primary;\n    file \"\/var\/lib\/bind\/example.test.zone\";\n    dnssec-policy default;\n    inline-signing yes;\n};<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Seconds after starting, BIND had created a key and signed every record:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ rndc dnssec -status example.test\ndnssec-policy: default\n...\nkey: 19355 (ECDSAP256SHA256), CSK\n  published:      yes - since ...\n  key signing:    yes - since ...\n  zone signing:   yes - since ...\n\n$ dig @127.0.0.1 example.test DNSKEY +noall +answer | dnssec-dsfromkey -f - example.test\nexample.test. IN DS 19355 13 2 422097AECED89938C32A1B4A02CC7BE5C1E785AFFE00FBE09A20516A7990CDDA<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The DS line is what you give your registrar. The <a href=\"https:\/\/bind9.readthedocs.io\/en\/stable\/dnssec-guide.html\" target=\"_blank\" rel=\"noopener noreferrer\">BIND DNSSEC guide<\/a> notes that <code>dnssec-policy<\/code> needs inline signing or dynamic DNS, that BIND handles key rollovers itself, and that you confirm the DS is live with <code>rndc dnssec -checkds published example.test<\/code> unless you configure <code>parental-agents<\/code> so BIND checks for you.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The mistake that takes domains offline<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The classic way to break a signed domain is to move it to new name servers while the old DS record is still at the registrar. The new DNS host has different keys, the DS no longer matches, and validating resolvers return SERVFAIL, exactly like <code>dnssec-failed.org<\/code> above. Cloudflare&#8217;s documentation says to make sure DNSSEC is disabled at the registrar before changing name servers, and to wait for the old DS record&#8217;s TTL to expire; it suggests 24 to 48 hours. The cPanel documentation gives the same basic rule: to disable DNSSEC, remove the DS record from the registrar.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A safe order when you move DNS hosting:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Remove the DS record at the registrar.<\/li>\n\n\n\n<li>Wait until <code>dig +short DS yourdomain.com<\/code> on public resolvers returns nothing and the old TTL has passed.<\/li>\n\n\n\n<li>Change the name servers.<\/li>\n\n\n\n<li>Once the new DNS host answers, sign the zone there and add its new DS record.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Should you turn DNSSEC on?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For most domains, yes, once you understand the moving parts: it removes a whole class of spoofing attacks, and managed DNS hosts, cPanel with PowerDNS and BIND&#8217;s <code>dnssec-policy<\/code> all handle the signing for you. Be more careful if you run your own name servers without monitoring, or if you move DNS providers often; a forgotten DS record hurts more than no DNSSEC at all. If you are new to name servers, start with <a href=\"https:\/\/www.ucartz.com\/clients\/knowledgebase\/9289\/What-Is-a-Nameserver-How-to-Find-and-Change-Yours.html\">What Is a Nameserver?<\/a> and our guide to <a href=\"https:\/\/www.ucartz.com\/clients\/knowledgebase\/9279\/DNS-Lookup-Commands-How-to-Use-dig-nslookup-and-host.html\">dig, nslookup and host<\/a>. If you want to run your own signed DNS server, a <a href=\"https:\/\/www.ucartz.com\/kvm-vps\">KVM VPS<\/a> with full root access gives you the control BIND or PowerDNS needs.<\/p>\n\n","protected":false},"excerpt":{"rendered":"<p>What DNSSEC is, how the chain of trust works, how to check a domain with dig and delv, how to enable it, and the DS record mistake that breaks sites.<\/p>\n","protected":false},"author":5,"featured_media":4236,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[237,397],"tags":[1097,1096,946,941,1093,1095,1092,1094],"class_list":["post-4235","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-networking","category-security","tag-bind","tag-delv","tag-dig","tag-dns","tag-dns-security","tag-dnskey","tag-dnssec","tag-ds-record"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>What Is DNSSEC? How It Works and How to Check It | Ucartz<\/title>\n<meta name=\"description\" content=\"What DNSSEC is, how the chain of trust works, how to check a domain with dig and delv, how to enable it, and the DS record mistake that breaks sites.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.ucartz.com\/blog\/what-is-dnssec\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"| Ucartz Blog | Ucartz\" \/>\n<meta property=\"og:description\" content=\"What DNSSEC is, how the chain of trust works, how to check a domain with dig and delv, how to enable it, and the DS record mistake that breaks sites.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.ucartz.com\/blog\/what-is-dnssec\/\" \/>\n<meta property=\"og:site_name\" content=\"Ucartz Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/UcartzOnline\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-05T07:21:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-09T22:05:05+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.ucartz.com\/blog\/wp-content\/uploads\/2026\/11\/what-is-dnssec.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Ashily Shaji\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"| Ucartz Blog | Ucartz\" \/>\n<meta name=\"twitter:creator\" content=\"@ucartz\" \/>\n<meta name=\"twitter:site\" content=\"@ucartz\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ashily Shaji\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/what-is-dnssec\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/what-is-dnssec\\\/\"},\"author\":{\"name\":\"Ashily Shaji\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/#\\\/schema\\\/person\\\/ed6b098cc94c224512e124471f674d69\"},\"headline\":\"What Is DNSSEC? How It Works and How to Check It\",\"datePublished\":\"2026-11-05T07:21:00+00:00\",\"dateModified\":\"2026-11-09T22:05:05+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/what-is-dnssec\\\/\"},\"wordCount\":1382,\"publisher\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/what-is-dnssec\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/what-is-dnssec.jpg\",\"keywords\":[\"bind\",\"delv\",\"dig\",\"dns\",\"dns security\",\"dnskey\",\"dnssec\",\"ds record\"],\"articleSection\":[\"Networking\",\"Security\"],\"inLanguage\":\"en-US\"},{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/what-is-dnssec\\\/\",\"url\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/what-is-dnssec\\\/\",\"name\":\"| Ucartz Blog | Ucartz\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/what-is-dnssec\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/what-is-dnssec\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/what-is-dnssec.jpg\",\"datePublished\":\"2026-11-05T07:21:00+00:00\",\"dateModified\":\"2026-11-09T22:05:05+00:00\",\"description\":\"What DNSSEC is, how the chain of trust works, how to check a domain with dig and delv, how to enable it, and the DS record mistake that breaks sites.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/what-is-dnssec\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/what-is-dnssec\\\/\"]}]},{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/what-is-dnssec\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/what-is-dnssec.jpg\",\"contentUrl\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/what-is-dnssec.jpg\",\"width\":1200,\"height\":630,\"caption\":\"What Is DNSSEC? How It Works and How to Check It\"},{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/what-is-dnssec\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"What Is DNSSEC? How It Works and How to Check It\"}]},{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/\",\"name\":\"Ucartz Blog\",\"description\":\"Guides on hosting, servers, streaming and automation\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/#organization\"},\"alternateName\":\"Ucartz\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/#organization\",\"name\":\"Ucartz Online Private Limited\",\"alternateName\":\"Ucartz\",\"url\":\"https:\\\/\\\/www.ucartz.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.ucartz.com\\\/assets\\\/images\\\/brand\\\/logo\\\/ucartz-logo-888x240.png\",\"contentUrl\":\"https:\\\/\\\/www.ucartz.com\\\/assets\\\/images\\\/brand\\\/logo\\\/ucartz-logo-888x240.png\",\"width\":888,\"height\":240,\"caption\":\"Ucartz\"},\"image\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/UcartzOnline\",\"https:\\\/\\\/twitter.com\\\/ucartz\",\"https:\\\/\\\/www.instagram.com\\\/ucartz_com\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/ucartzonline\",\"https:\\\/\\\/github.com\\\/ucartz\",\"https:\\\/\\\/n8n.io\\\/creators\\\/ucartz\\\/\",\"https:\\\/\\\/marketplace.whmcs.com\\\/group\\\/Ucartz\"]},{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/#\\\/schema\\\/person\\\/ed6b098cc94c224512e124471f674d69\",\"name\":\"Ashily Shaji\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/wp-content\\\/themes\\\/ucartz-blog\\\/assets\\\/images\\\/authors\\\/ashily-112.webp\",\"url\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/wp-content\\\/themes\\\/ucartz-blog\\\/assets\\\/images\\\/authors\\\/ashily-112.webp\",\"contentUrl\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/wp-content\\\/themes\\\/ucartz-blog\\\/assets\\\/images\\\/authors\\\/ashily-112.webp\",\"caption\":\"Ashily Shaji\"},\"sameAs\":[\"https:\\\/\\\/www.ucartz.com\\\/\"],\"url\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/author\\\/ashily\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What Is DNSSEC? How It Works and How to Check It | Ucartz","description":"What DNSSEC is, how the chain of trust works, how to check a domain with dig and delv, how to enable it, and the DS record mistake that breaks sites.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.ucartz.com\/blog\/what-is-dnssec\/","og_locale":"en_US","og_type":"article","og_title":"| Ucartz Blog | Ucartz","og_description":"What DNSSEC is, how the chain of trust works, how to check a domain with dig and delv, how to enable it, and the DS record mistake that breaks sites.","og_url":"https:\/\/www.ucartz.com\/blog\/what-is-dnssec\/","og_site_name":"Ucartz Blog","article_publisher":"https:\/\/www.facebook.com\/UcartzOnline","article_published_time":"2026-11-05T07:21:00+00:00","article_modified_time":"2026-11-09T22:05:05+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.ucartz.com\/blog\/wp-content\/uploads\/2026\/11\/what-is-dnssec.jpg","type":"image\/jpeg"}],"author":"Ashily Shaji","twitter_card":"summary_large_image","twitter_title":"| Ucartz Blog | Ucartz","twitter_creator":"@ucartz","twitter_site":"@ucartz","twitter_misc":{"Written by":"Ashily Shaji","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@context":"https:\/\/schema.org","@type":"Article","@id":"https:\/\/www.ucartz.com\/blog\/what-is-dnssec\/#article","isPartOf":{"@id":"https:\/\/www.ucartz.com\/blog\/what-is-dnssec\/"},"author":{"name":"Ashily Shaji","@id":"https:\/\/www.ucartz.com\/blog\/#\/schema\/person\/ed6b098cc94c224512e124471f674d69"},"headline":"What Is DNSSEC? How It Works and How to Check It","datePublished":"2026-11-05T07:21:00+00:00","dateModified":"2026-11-09T22:05:05+00:00","mainEntityOfPage":{"@id":"https:\/\/www.ucartz.com\/blog\/what-is-dnssec\/"},"wordCount":1382,"publisher":{"@id":"https:\/\/www.ucartz.com\/#organization"},"image":{"@id":"https:\/\/www.ucartz.com\/blog\/what-is-dnssec\/#primaryimage"},"thumbnailUrl":"https:\/\/www.ucartz.com\/blog\/wp-content\/uploads\/2026\/11\/what-is-dnssec.jpg","keywords":["bind","delv","dig","dns","dns security","dnskey","dnssec","ds record"],"articleSection":["Networking","Security"],"inLanguage":"en-US"},{"@context":"https:\/\/schema.org","@type":"WebPage","@id":"https:\/\/www.ucartz.com\/blog\/what-is-dnssec\/","url":"https:\/\/www.ucartz.com\/blog\/what-is-dnssec\/","name":"| Ucartz Blog | Ucartz","isPartOf":{"@id":"https:\/\/www.ucartz.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.ucartz.com\/blog\/what-is-dnssec\/#primaryimage"},"image":{"@id":"https:\/\/www.ucartz.com\/blog\/what-is-dnssec\/#primaryimage"},"thumbnailUrl":"https:\/\/www.ucartz.com\/blog\/wp-content\/uploads\/2026\/11\/what-is-dnssec.jpg","datePublished":"2026-11-05T07:21:00+00:00","dateModified":"2026-11-09T22:05:05+00:00","description":"What DNSSEC is, how the chain of trust works, how to check a domain with dig and delv, how to enable it, and the DS record mistake that breaks sites.","breadcrumb":{"@id":"https:\/\/www.ucartz.com\/blog\/what-is-dnssec\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.ucartz.com\/blog\/what-is-dnssec\/"]}]},{"@context":"https:\/\/schema.org","@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.ucartz.com\/blog\/what-is-dnssec\/#primaryimage","url":"https:\/\/www.ucartz.com\/blog\/wp-content\/uploads\/2026\/11\/what-is-dnssec.jpg","contentUrl":"https:\/\/www.ucartz.com\/blog\/wp-content\/uploads\/2026\/11\/what-is-dnssec.jpg","width":1200,"height":630,"caption":"What Is DNSSEC? How It Works and How to Check It"},{"@context":"https:\/\/schema.org","@type":"BreadcrumbList","@id":"https:\/\/www.ucartz.com\/blog\/what-is-dnssec\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.ucartz.com\/blog\/"},{"@type":"ListItem","position":2,"name":"What Is DNSSEC? How It Works and How to Check It"}]},{"@context":"https:\/\/schema.org","@type":"WebSite","@id":"https:\/\/www.ucartz.com\/blog\/#website","url":"https:\/\/www.ucartz.com\/blog\/","name":"Ucartz Blog","description":"Guides on hosting, servers, streaming and automation","publisher":{"@id":"https:\/\/www.ucartz.com\/#organization"},"alternateName":"Ucartz","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.ucartz.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@context":"https:\/\/schema.org","@type":"Organization","@id":"https:\/\/www.ucartz.com\/#organization","name":"Ucartz Online Private Limited","alternateName":"Ucartz","url":"https:\/\/www.ucartz.com\/","logo":{"@type":"ImageObject","@id":"https:\/\/www.ucartz.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.ucartz.com\/assets\/images\/brand\/logo\/ucartz-logo-888x240.png","contentUrl":"https:\/\/www.ucartz.com\/assets\/images\/brand\/logo\/ucartz-logo-888x240.png","width":888,"height":240,"caption":"Ucartz"},"image":{"@id":"https:\/\/www.ucartz.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/UcartzOnline","https:\/\/twitter.com\/ucartz","https:\/\/www.instagram.com\/ucartz_com","https:\/\/www.linkedin.com\/company\/ucartzonline","https:\/\/github.com\/ucartz","https:\/\/n8n.io\/creators\/ucartz\/","https:\/\/marketplace.whmcs.com\/group\/Ucartz"]},{"@context":"https:\/\/schema.org","@type":"Person","@id":"https:\/\/www.ucartz.com\/blog\/#\/schema\/person\/ed6b098cc94c224512e124471f674d69","name":"Ashily Shaji","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.ucartz.com\/blog\/wp-content\/themes\/ucartz-blog\/assets\/images\/authors\/ashily-112.webp","url":"https:\/\/www.ucartz.com\/blog\/wp-content\/themes\/ucartz-blog\/assets\/images\/authors\/ashily-112.webp","contentUrl":"https:\/\/www.ucartz.com\/blog\/wp-content\/themes\/ucartz-blog\/assets\/images\/authors\/ashily-112.webp","caption":"Ashily Shaji"},"sameAs":["https:\/\/www.ucartz.com\/"],"url":"https:\/\/www.ucartz.com\/blog\/author\/ashily\/"}]}},"_links":{"self":[{"href":"https:\/\/www.ucartz.com\/blog\/wp-json\/wp\/v2\/posts\/4235","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ucartz.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ucartz.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ucartz.com\/blog\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ucartz.com\/blog\/wp-json\/wp\/v2\/comments?post=4235"}],"version-history":[{"count":1,"href":"https:\/\/www.ucartz.com\/blog\/wp-json\/wp\/v2\/posts\/4235\/revisions"}],"predecessor-version":[{"id":4250,"href":"https:\/\/www.ucartz.com\/blog\/wp-json\/wp\/v2\/posts\/4235\/revisions\/4250"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ucartz.com\/blog\/wp-json\/wp\/v2\/media\/4236"}],"wp:attachment":[{"href":"https:\/\/www.ucartz.com\/blog\/wp-json\/wp\/v2\/media?parent=4235"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ucartz.com\/blog\/wp-json\/wp\/v2\/categories?post=4235"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ucartz.com\/blog\/wp-json\/wp\/v2\/tags?post=4235"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}