How does DNSSEC work?
DNSSEC adds a digital signature to each piece of a domain name's DNS information. When a visitor enters the domain name's URL in a browser, the resolver (the conversion from the people-friendly domain name URL to the numeric address used by the Internet) verifies the digital signature. The digital signature must match the value on file at the registry, or the resolver discards the response.
Here's another way to look at it: Site A has information that Visitor B wants. The messenger, i.e., the resolver, receives the information from Site A but delivers it to Visitor B only if Site A can identify itself properly. To authenticate Site A, the messenger matches Site A's fingerprints against fingerprints on file for it at the registry.
DNSSEC's digital signature ensures that you're communicating with the site or Internet location you intended to visit.
