DNSSEC adds which security property to DNS?

1. DNSSEC (DNS Security Extensions): adds DIGITAL SIGNATURES to DNS records. 2. PROVIDES: • AUTHENTICITY: the DNS response is signed by the authoritative zone's key. • INTEGRITY: any tampering with the response invalidates the signature. 3. DOES NOT PROVIDE: • Confidentiality (queries and responses are still cleartext). • For encryption, use DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) ON TOP of DNSSEC. 4. PROTECTS AGAINST: cache poisoning attacks (e.g. Kaminsky 2008) that injected fake DNS records. 5. Adoption is still uneven — many resolvers and authoritative servers don't yet validate or sign. _Source: RFC 4033 (DNSSEC introduction + requirements)._