Before DNSSEC
1. A user requests a domain name (e.g., www.example.my).
2. The DNS resolver queries the authoritative name server.
3. The authoritative name server returns the DNS response.
4. The DNS resolver accepts the response and returns it to the user.
In this model, the DNS resolver has no way to verify whether the DNS response is authentic or has been modified during transmission.
After DNSSEC
1. A user requests a domain name (e.g., www.example.my).
2. The DNS resolver queries the authoritative name server.
3. The authoritative name server returns the DNS response together with DNSSEC signature information.
4. The DNS resolver validates the digital signatures using the DNSSEC chain of trust.
5.If the validation succeeds, the DNS resolver accepts the response and returns it to the user.
6. If the validation fails, the DNS resolver rejects the response.
Key Difference
Without DNSSEC, DNS resolvers trust DNS responses without verification. With DNSSEC, DNS resolvers verify the authenticity and integrity of DNS data before accepting it. This helps protect users against DNS spoofing, cache poisoning, and traffic hijacking attacks.