DNSSEC, and whether you need it
It signs the answers so a resolver can tell a real one from a forged one. What that fixes, and what it does not.
Updated 02 Sept 2026
The naming system was built without a way to tell whether an answer came from the right place. ডিএনএসসেক adds one: each answer is signed, and a resolver that checks the signature can reject a forged reply instead of believing it.
What it protects against
One attack, precisely: somebody answering a lookup before the real nameserver does, and sending your visitors to their server. It is not common, and when it happens it is invisible to the visitor — the address bar reads correctly because the name is correct; only the answer behind it is not.
What it does not do
It does not encrypt anything, hide anything or protect the site itself. It says an answer is authentic, not that it is private and not that what it points at is safe. Your certificate is what protects the connection, and the two solve different halves.
The part that makes it fragile
A signed zone has to be published at the registry as well, through a delegation record that says which key to trust. Two systems now have to agree, and a signed zone whose registry record is stale does not degrade — it stops resolving, for everybody, with no warning and nothing wrong on the page.
Should I turn it on?
If you run a bank, a payment service or a login that matters to strangers, yes. For a business site or a shop, the honest answer is that it is a long way down the list — a working certificate, backups and a current WordPress prevent far more real incidents than this does.
Does it slow ডিএনএস down?
Barely, and not in a way a visitor notices. The cost is not speed but operational: one more thing that has to stay in step, on a system where being out of step means being unreachable rather than being slow.