DNSSEC

DNSSEC (DNS Security Extensions) adds a layer of trust to DNS by digitally signing DNS records. Without DNSSEC, there is no way to verify that a DNS response actually came from the legitimate nameserver. An attacker could forge responses and redirect you to a malicious site (DNS spoofing). With DNSSEC enabled, your resolver can verify the cryptographic signature on each response to confirm it is authentic and has not been tampered with. Not all domains use DNSSEC, but adoption is growing.