DNSSEC vs DNS over HTTPS (DoH)

DNSSEC and DNS over HTTPS (DoH) are both DNS security technologies, but they solve fundamentally different problems. DNSSEC proves that DNS answers have not been tampered with. DoH hides DNS queries from network observers. They are complementary, not competing.

TL;DR

• DNSSEC adds cryptographic signatures to DNS records. Resolvers can verify that an answer is authentic and unmodified — but the query and response are still visible on the wire.
• DoH wraps DNS queries inside an encrypted HTTPS connection between the client and the resolver. Eavesdroppers cannot see which domains you look up — but DoH says nothing about whether the answer is genuine.
• Using both together gives you authenticated answers delivered over an encrypted channel.

---

They Solve Different Problems

---

How DNSSEC Works

DNSSEC adds a chain of trust from the DNS root zone down to your domain. Each level cryptographically signs the next:

1. The root zone publishes its own DNSKEY and signs the DS records for each TLD.
2. The TLD (e.g. .eu) publishes its DNSKEY and signs DS records for domains under it.
3. Your zone (e.g. dnscale.eu) publishes its DNSKEY and signs every record set with RRSIG signatures.

A validating resolver walks this chain from the root to your domain. If any signature fails, the response is rejected. This prevents:

• Cache poisoning — an attacker cannot inject forged records because they cannot produce valid signatures.
• Man-in-the-middle modification — even if an attacker intercepts the response, altering it breaks the cryptographic signature.

What DNSSEC does not do

DNSSEC does not encrypt anything. Queries and responses travel in plaintext. An observer on the network can see every domain you look up and every answer you receive. DNSSEC only guarantees that the answer is the one the zone owner published.

---

How DNS over HTTPS Works

DoH wraps standard DNS queries inside an HTTPS connection (port 443) between the client — typically a browser or OS stub resolver — and a DoH-capable recursive resolver.

1. The client opens a TLS-encrypted HTTPS connection to the resolver (e.g. https://dns.example.com/dns-query).
2. DNS queries are sent as HTTP requests (GET or POST) with the application/dns-message content type.
3. The resolver decrypts the query, resolves it normally (contacting authoritative servers over standard DNS), and returns the answer over the same encrypted channel.

Because the connection uses TLS, anyone between the client and the resolver — ISPs, Wi-Fi operators, corporate proxies — sees only encrypted HTTPS traffic to the resolver's IP address. They cannot see which domains are being queried.

What DoH does not do

DoH only encrypts the first hop — from the client to the resolver. The resolver still contacts authoritative nameservers over standard, unencrypted DNS. DoH also does not verify that answers are genuine. If the resolver itself is compromised, or if it receives a poisoned answer from an upstream server, DoH will dutifully deliver that forged answer over a perfectly encrypted channel.

---

Why You Need Both

Running DNSSEC-signed zones and using a DoH-capable validating resolver gives you defence in depth: authenticity from DNSSEC, privacy from DoH.

---

DNSSEC with DNScale

DNScale supports DNSSEC out of the box. You can enable signing and manage keys from the dashboard or via the API:

1. Open your zone in the DNScale dashboard and click the Shield icon.
2. Click Generate Key Pair to create a signing key (CSK with ECDSAP256SHA256).
3. Copy the DS records and add them at your domain registrar.
4. Once the DS records propagate, your zone is DNSSEC-protected.

For detailed key management, including rollovers, see the DNSSEC Key Management guide.

---

Key Takeaways

• DNSSEC and DoH are not interchangeable — they protect against different threats.
• DNSSEC proves records are authentic via a cryptographic chain of trust. It does not encrypt.
• DoH encrypts queries between the client and resolver. It does not verify authenticity.
• For comprehensive DNS security, deploy DNSSEC on your zones and use a DoH-capable validating resolver.

---

Further Reading

• DNSSEC Key Management — Key generation, DS records, and safe rollovers
• DNS Attacks and Threats — Common DNS attack vectors and mitigations
• What Is a TLSA Record — DANE/TLSA for certificate pinning via DNS
• SSL and TLS Certificates Explained — How TLS secures connections