What is the PRIMARY goal for using Domain Name System Security Extensions (DNSSEC) to sign records?

DNSSEC uses digital signatures (via asymmetric cryptography) to sign DNS resource records, allowing resolvers to verify that the data originated from an authoritative source and has not been modified in transit. This directly addresses data integrity by detecting forged or altered DNS responses, protecting against attacks such as DNS cache poisoning. Confidentiality is explicitly out of scope for DNSSEC, as it does not encrypt DNS data.

DNSSEC does not encrypt DNS query or response data, so it provides no confidentiality; DNS over HTTPS (DoH) or DNS over TLS (DoT) are the mechanisms used for that purpose.

Accountability refers to tracking actions to specific users or entities; DNSSEC authenticates data origin but does not log or attribute user activity in any way.

Availability concerns ensuring services remain accessible; DNSSEC does not protect against denial-of-service attacks and can actually introduce additional overhead that slightly impacts availability.