Which statement best describes the purpose of DNSSEC?

• A. It adds cryptographic signatures to DNS data to ensure authenticity and integrity of responses, preventing cache poisoning.
• B. It provides end-to-end encryption for DNS queries.
• C. It speeds up DNS resolution by caching results more aggressively.
• D. It blocks DNS queries from untrusted networks.

Answer: (A)

DNSSEC adds cryptographic signatures to DNS data to ensure authenticity and integrity, preventing cache poisoning. By signing zone data (with records like RRSIG and DNSKEY) and establishing a chain of trust from the root down to each zone, resolvers can verify that the response truly comes from the authoritative source and hasn’t been tampered with in transit. If the data or signature don’t match the trusted keys, validation fails, protecting users from forged responses intended to misdirect them. It’s important to note that DNSSEC does not encrypt DNS queries or responses, so it doesn’t provide confidentiality, and it doesn’t speed up resolution or block traffic based on trust of networks.