DNSSEC (Domain Name System Security Extensions) adds cryptographic signatures to DNS data so validating resolvers can verify that DNS responses are authentic.
For a signed domain, a resolver can compare the DNS server's DNSKEY information with the DS record published through the parent/registrar. A valid chain helps protect against forged DNS responses such as spoofing.
cPanel's current DNSSEC implementation requires PowerDNS on the server. DNSSEC also requires correct coordination with the domain registrar; creating a key only in cPanel is not enough. The corresponding DS data must be published at the registrar.
