is a set of extensions to DNS that provide the origin authentication of DNS data to DNS clients (resolvers) so as to reduce the threat of DNS poisoning, spoofing, and similar types of attacks.

DNSSEC, defined in IETF RFCs 4033-4035, extends DNS by adding digital signatures to resource records so that resolvers can cryptographically verify that responses originate from the authoritative source and have not been modified in transit. It directly mitigates DNS cache poisoning and spoofing by providing both data origin authentication and data integrity guarantees.

Resource records are the fundamental data units stored in DNS zones (such as A, MX, and CNAME records) and are not a security extension or authentication mechanism.

Resource transfer is not a defined standard DNS term or protocol; it does not correspond to any recognized DNS security or data-replication mechanism.

Zone transfer (AXFR/IXFR) is a protocol for replicating DNS zone data from a primary to a secondary server and provides no cryptographic authentication or protection against spoofing.