_________ is a set of extensions to DNS that provide to DNS clients (resolvers) origin authentication of DNS data to reduce the threat of DNS poisoning, spoofing, and similar attacks types.

DNSSEC (Domain Name System Security Extensions) uses public-key cryptography to digitally sign DNS resource records, allowing a validating resolver to confirm that a response originated from an authoritative source and has not been tampered with in transit. This directly mitigates threats like cache poisoning and DNS spoofing by providing origin authentication and data integrity verification.

Resource records (A, MX, CNAME, etc.) are the standard data entries stored in DNS zones; they carry information but provide no authentication or security mechanism on their own.

Resource transfer is not a recognized DNS protocol or specification; it does not describe any real DNS security or data-transfer mechanism.

Zone transfer (AXFR/IXFR) is a replication mechanism that copies DNS zone data from a primary to a secondary server and is not related to authenticating DNS responses for clients.