DNSSEC
Problem
Your DNS resolver asks:
What's the IP of bank.com?
An attacker manages to provide a fake DNS answer.
Ordinary DNS doesn't inherently prove that the received DNS data is authentic.
Solution — DNSSEC
DNS zones cryptographically sign DNS data.
Resolvers that validate DNSSEC can verify those signatures through a chain of trust.
Core idea: DNSSEC provides authenticity and integrity for DNS data; it does not encrypt DNS queries.