DNS security · on by default

DNSSEC-Validated Private DNS

DNS was never designed to be trustworthy — a query travels in plain text and any attacker on the path can forge a reply. This is DNS spoofing: an attacker injects a fake answer before the real one arrives, silently redirecting your browser to a phishing site or a malware server while everything still looks normal. DNSSEC fixes this by cryptographically signing DNS records, so a resolver can verify that the answer it received really came from the authoritative source and wasn't altered in transit.

How DNSSEC validation protects you

Cryptographic signatures

Every DNSSEC-signed zone chains a digital signature from the root down to the answer, so forged records fail verification instantly.

Spoofing blocked

An attacker injecting a fake reply cannot produce a valid signature, so the forged answer is rejected before it ever reaches your device.

Cache poisoning blocked

Poisoning a resolver's cache with a bogus record requires forging a signature too — DNSSEC makes that cryptographically infeasible.

Man-in-the-middle blocked

A network attacker between you and the resolver cannot rewrite validated answers without breaking the signature chain and being detected.

DNSSEC vs encryption — two different, complementary layers

People often confuse the two. They protect different things, and AEU DNS gives you both.

DNSSEC = authenticity of the data

It proves the DNS answer is genuine and unmodified. It does not hide the query from anyone watching the network — DNSSEC alone is not private.

Encryption = privacy of the transport

DoH, DoT and DoQ seal the query so a network observer cannot read or tamper with it in transit. Encryption alone does not prove the resolver's answer is authentic end-to-end.

Together = full-stack trust

AEU DNS validates DNSSEC on every answer AND carries every query over encrypted DoH/DoT/DoQ transport, so your DNS is both authentic and private — content integrity plus transport confidentiality.

On by default — nothing to configure

DNSSEC validation is active on every AEU DNS query the moment you connect — there is no setting to find or toggle. Combined with our no-log policy and post-quantum encrypted transports, it is one more layer of protection that just works.

Get DNSSEC-validated private DNS in two minutes

Create a free account, get your DNS profile and a personal certificate, and copy-paste one configuration onto any device.

Create your account

Keep exploring

Start from the AEU DNS home page, or read how encrypted DNS works for a plain-language walk-through of how encrypted DNS protects you. See how DNS-over-QUIC adds an extra transport layer, or check our GDPR-compliant DNS explainer for compliance.

Frequently asked questions

What is DNSSEC?

DNSSEC (Domain Name System Security Extensions) adds cryptographic signatures to DNS records, letting a resolver verify that an answer genuinely came from the authoritative source and was not forged or altered in transit.

Does AEU DNS validate DNSSEC?

Yes. AEU DNS validates DNSSEC on every query by default — there is nothing to enable. Any answer that fails validation is rejected rather than passed on to your device.

DNSSEC vs encrypted DNS — what's the difference?

DNSSEC proves the DNS answer itself is authentic and unmodified; it does not hide the query from network observers. Encrypted transport (DoH/DoT/DoQ) hides the query from observers but does not by itself prove the answer is authentic end-to-end. AEU DNS gives you both together.

Do I need to enable it?

No. DNSSEC validation runs automatically on every AEU DNS query the moment you connect — no settings, no toggles, nothing to configure.

Can DNSSEC alone stop someone from reading my DNS queries?

No. DNSSEC only proves an answer is authentic — it does not encrypt the query. To keep queries private from network observers you also need encrypted transport, which is exactly what AEU DNS provides via DoH, DoT and DoQ alongside DNSSEC validation.