About DNSSEC
DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records, letting resolvers verify that answers haven't been tampered with in transit. A fully secure domain has both a DNSKEY record in its own zone and a DS (Delegation Signer) record published by the parent zone, without the DS, the chain of trust is broken and resolvers won't validate. The AD flag (Authenticated Data) in a resolver response confirms it has successfully validated the signatures. Many registrars and DNS hosts support DNSSEC but require it to be explicitly enabled.