DNSSEC adds digital signatures to a domain name's DNS records. These signatures allow DNS resolvers to verify that the DNS information comes from a trusted source and has not been altered.

When a user accesses a website, a DNSSEC-aware resolver checks the digital signatures before accepting the DNS response. If the signatures are valid, the DNS information is trusted. If not, the response is rejected.

This helps protect users from DNS spoofing, DNS cache poisoning, and traffic hijacking attacks.