DNSSEC adds digital signatures to DNS records so resolvers can verify that answers really come from the domain's authoritative source and were not altered. It protects integrity, not privacy: DNS data is signed, not encrypted.