Domain Transfer Locks and Ownership Controls
Continue through the next layer of the domain-to-browser path.
Read the guide →Plain-English security
What is DNSSEC, and how does it detect forged DNS?
DNS is the internet's phone book — it translates your domain name into the address of your actual server. DNSSEC adds cryptographic signatures to your domain's answers so resolvers can verify they're genuine. Without it, a forged answer can silently send your visitors — or your email — somewhere else, and nothing on their screen looks wrong.
The attack this stops
Every visit to your site starts with a DNS question: where does this domain live? That question and answer travel through infrastructure neither you nor your visitor controls, and unsigned answers can be forged in transit. A visitor who receives a forged answer lands on the attacker's server while their browser still shows your domain name.
What makes this class of attack nasty is that nothing of yours is touched. Your server is fine, your site is fine — the phone book lied, and the lie happened between your visitor and you. Mail is a target too: forged answers can redirect where your inbound email gets delivered.
DNSSEC makes signed answers verifiable. When the chain of trust is intact, a validating resolver can detect a forged or altered answer instead of silently accepting it. Resolvers that do not validate DNSSEC do not gain that protection.
Honest framing: what it is and isn't
DNSSEC is infrastructure hygiene, not a headline feature — our own scan grades it as a lower-priority item for a typical small-business site, and that's deliberate. The attacks it prevents are less common than spoofed email or scanner probes, but they're the quiet, hard-to-detect kind, and the defense costs nothing once enabled.
The reason most domains don't have it is historical: enabling it used to be an error-prone manual process where mistakes could take a domain offline. On modern managed DNS platforms it has become close to a toggle — the operational risk that once justified skipping it mostly no longer exists.
Check your own site in 30 seconds
The free WolfWarden scan reads this — plus seven other fundamentals — from public information and grades it in plain English. Nothing to install. Ordinary results may be cached briefly to prevent abuse; no lasting report is created unless you choose to share one.
Run the free scanCommon questions
Does DNSSEC encrypt my DNS or my website traffic?
No — that's the most common misconception. DNSSEC proves DNS answers are authentic; it doesn't hide them. Encrypting website traffic is the HTTPS certificate's job. The two protections are complementary.
Can enabling DNSSEC break my domain?
If misconfigured, yes — a broken signature chain makes validating resolvers reject the domain entirely. That's why it should be enabled through a provider that automates the signing, and monitored afterward.
Is DNSSEC required?
No, and most domains still don't use it. It's a low-cost hardening step: the attack it stops is uncommon but nearly invisible when it happens, and the defense is essentially free on modern DNS platforms.
If you'd rather not manage this
The relevant service page explains what WolfWarden can handle, what the public scan cannot see, and where a managed plan or focused project fits.