DNSSEC addresses DNS's fundamental flaw through digital signature mechanisms: traditional DNS responses have no integrity checking, so a man-in-the-middle can forge responses and steer users to malicious addresses (cache poisoning). With DNSSEC enabled, a zone generates an RRSIG signature for each record, and resolvers verify the signatures along the chain of trust, setting the AD flag in the response header only if verification passes.