Which statement best describes DNSSEC?

• A. DNSSEC provides origin authentication of DNS data to reduce threats like DNS poisoning and spoofing.
• B. DNSSEC encrypts DNS queries end to end to protect privacy.
• C. DNSSEC replaces DNS with a new secure protocol.
• D. DNSSEC increases TTL values in DNS records.

Answer: (A)

DNSSEC ensures the origin and integrity of DNS data. It signs DNS records so that a resolver can verify the data actually came from the domain’s authoritative server and hasn’t been altered in transit, creating a chain of trust from the root down to each zone. This directly helps prevent DNS poisoning and spoofing by making tampering detectable. It does not encrypt DNS queries for privacy—that’s handled by other technologies like DNS over TLS or DNS over HTTPS. It also doesn’t replace DNS with a new secure protocol, and TTLs are independent of DNSSEC.