What does DNSSEC add to the original DNS design?

• A. Backward incompatible security features
• B. Security while maintaining backward compatibility
• C. Higher performance with less compatibility
• D. Dynamic updates of zone data

Answer: (B)

DNSSEC adds security to the existing DNS by attaching cryptographic signatures to DNS data, creating a chain of trust from the root down to individual zones. This means responses can be verified as authentic and unaltered, so you know the data really came from the expected zone and hasn’t been tampered with in transit. Importantly, this security layer is designed to work alongside the current DNS without requiring a complete rewrite or breaking existing deployments. Non-DNSSEC-aware resolvers can still function and receive data; they just won’t validate signatures, while DNSSEC-capable resolvers can verify and trust the responses that have been signed. So DNSSEC delivers security while keeping backward compatibility, rather than demanding changes that would break older systems. It’s not primarily about faster performance, dynamic updates, or encrypting the queries themselves.