How does my OS or browser knows to check for DNSSEC? How does the verification process works? Do I need a key from Comodo/Verisign? Do I need to install something to my hosting? What happens in men in middle attack? I have a man in middle attack case; the Turkish DNS providers show a page for my web site with "this site is blocked". Do all modern browsers support DNSSEC?
closed as too broad by Steffen Ullrich, Deer Hunter, Xander, Neil Smithline, WhiteWinterWolf Nov 8 '15 at 16:39
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
Answering this questions all at once is somewhat outside the scope of a question and answer site. I will provide you some insight:
DNSSEC secures the DNS data of a server, meaning that when your browser tries to connect a server, it needs to look up it's IP-address. This IP-address is queried via the DNS servers configured in your OS (Google provides some under 184.108.40.206 and 220.127.116.11). Useally your system will use the DNS resolver your ISP (Internet service provider) provides.
Since a domain owner did not instruct your ISP's DNS resolver directly, it will query an authoritative name server for that domain (NS). How do you know for example that your ISP didn't change the IP-address of the website you're trying to access? That's where DNSSEC kicks in!
Every domain (e.g. .com, .net, .org) is inside the DNS root zone. In the root zone are (public) keys provided by the operators of those subzones (e.g. .com). In case of .com it's VeriSign*. In the DNS .com zone are than keys for each individual domain if it supports DNSSEC.
Let's say you have your domain example.com at Namecheap and enabled DNSSEC. The DNS record is first fetched from Namecheap's NS servers, which singned the record. Your browser can check now if the record is valid according to that key and than go one level up in the chain to see if your key for example.com is found in the zone .com. The zone .com is signed by a key found in the DNS root zone, which is maintained by the ICANN.
Different to classic TLS/SSL you don't need a certification authority (CA) like COMODO, since every record is traced back to the DNS root zone. What you need instead is a domain registrar (Namecheap, GoDaddy) that supports DNSSEC and a domain that supports DNSSEC, since not every domain supports (therefor has keys in the root zone) like for example .com does.
Modern browsers don't have DNSSEC checks enabled by default. Hopefully that changes in the future. However this does not mean that DNSSEC provides no security, since your ISP's dns servers will likely check wherever the records it got are valid and if not not resolve the domain name into an IP-address.
*Confusing example since VeriSign is both a classic CA and operates domain zones.