DNSSEC, which stands for Domain Name System Security Extensions, is a set of extensions to DNS that adds an additional layer of security to the domain name system lookup and exchange processes.

The zone publishes DNSKEY records and the parent delegation publishes a DS record whose digest matches one of those keys, so a validating resolver can build an unbroken chain of trust to this domain. Note: this check verifies deployment and correct anchoring; it does not cryptographically validate every RRSIG signature over the zone's data.