DNSSEC is a suite of security extensions to enhance DNS security. (e.g.: avoid cache poisoning)
However I was wondering how does the resolver know that the next NS will use DNSSEC?
E.g.: Someone wants to resolve
Let's assume that the authoritative NS
example.com. has DNSSEC enabled and properly configured.
The resolver will first contact the root servers
., then the TLD servers
com. and finally the authoritative
example.com.. However, as the resolver send a DNS query to that last NS, he doesn't know if DNSSEC is enabled.
This means that an attacker may forge DNS packet and do his poisoning stuff...
I know I'm wrong, the resolver must be aware that the next NS uses DNSSEC. But I don't get how!?