The Domain Name System Security Extensions (DNSSEC) are a set of specifications that add cryptographic signatures to DNS records, letting a resolver verify that an answer genuinely came from the authoritative zone and was not altered along the way.
Ordinary DNS was designed without authentication, which is what makes cache poisoning possible: an attacker can slip a forged answer to a resolver and quietly redirect users to a malicious server. DNSSEC signs records and builds a chain of trust that runs from the DNS root zone down to the individual domain, so a resolver can reject responses whose signatures do not validate.
One point trips people up often. DNSSEC provides integrity and origin authentication, but not confidentiality, so the queries and answers still travel in cleartext for anyone on the path to read. Adoption remains uneven, and a mismanaged signing key or expired signature can take an otherwise healthy domain offline.
How is DNSSEC tested on the CISSP?
It appears in Domain 4, Communication and Network Security, weighted at 13%. The exam wants you to know exactly which protections DNSSEC adds and, just as important, which it does not, along with the threat of DNS cache poisoning it was built to counter.