DNSSEC

DNS Security Extensions let a zone sign its records so a validating resolver can tell a genuine answer from a forged one. The chain runs from a trust anchor, usually the root key, down through DS records to the zone's keys. It proves the DNS data is what the zone owner signed. It does not encrypt the query on the path, and it is not TLS for the website.

Validation is on or off at the resolver. A broken or missing signature should SERVFAIL at a validator, not maybe proceed. Key rollovers and DS updates at the parent are operational work. Get them wrong and the name disappears for anyone who validates.