DNSSEC: signing DNS answers — and what unsigned really means
2 min read
Should you worry when a whois result shows DNSSEC as unsigned? With Google and Microsoft themselves unsigned: what the field means, where it helps, how to enable it.
What DNSSEC solves
DNS is the internet's phone book, but by design it cannot prove an answer really came from the registry; a man-in-the-middle can return a fake IP (cache poisoning). DNSSEC signs DNS records cryptographically: the root zone signs the TLD, the TLD holds your domain's key (the DS record), and your zone signs its records. A validating resolver discards forged answers because the signature fails.
The DNSSEC field in our tool comes from the registry's official RDAP/whois answer: whether a DS record (the chain link) exists for the domain at the TLD.
Why unsigned is normal — the Google example
Most sites you query will show "Unsigned", and that alone is not a vulnerability: google.com, microsoft.com and amazon.com do not use DNSSEC. It is a deliberate engineering choice: a key-rollover mistake under DNSSEC can take a site fully offline worldwide for hours (validators reject badly signed answers — Slack's 2021 outage was exactly this). These giants prefer trusting their own anycast DNS plus the TLS layer.
On the other hand, DNSSEC is mandatory for .gov domains and growing in banking and critical infrastructure. In short: signed is a plus; unsigned is not an alarm. A site's primary identity guarantee is its TLS certificate — which you can test with SSLx.
Enabling it on your own domain
Two steps: your DNS provider signs the zone (one click on Cloudflare), then you add the generated DS record at your registrar. Caution: if you switch DNS providers and forget to remove the DS record first, your site goes dark on validating resolvers — that is the sharp edge of DNSSEC. Afterwards you can watch the field turn "Signed" in our tool.
Look up your own domain
Everything in this guide, our tool shows with live data in seconds: registration and expiry dates, registrar, nameservers, age and value analysis — free, no signup.
Query with WhoisFrequently asked questions
Are DNSSEC and HTTPS/SSL the same thing?
No; they are different layers. DNSSEC answers "did I reach the right IP", while a TLS certificate answers "is this really that server, and is the traffic encrypted". Neither replaces the other.
Is visiting an unsigned site risky?
Not by itself: HTTPS already defeats most fake-IP attacks (the certificate will not match). DNSSEC is an extra defence layer; its absence is the majority state of today's internet.