DNS and domains
DNSSEC
Cryptographic signatures on DNS records, with a chain of trust from the root, so a resolver can tell a forged answer from the real one.
DNS answers are not signed by default: a resolver has to trust whatever comes back, and a forged answer sends everyone behind that resolver to the wrong server. DNSSEC adds signatures to the records and a chain of trust. The root vouches for .lu, .lu vouches for your zone through a DS record, and your zone's keys sign each record.
A validating resolver (most public ones and most ISP resolvers today) checks the chain and rejects answers whose signatures do not match. It fails closed: a zone whose DS record points at a key that is not in the zone returns SERVFAIL for everyone behind a validating resolver, which is what happens when a domain moves DNS hosts with the old DS still at the registry.
DNSSEC proves authenticity, not confidentiality; it does not encrypt anything. It is the foundation for DANE and the reason records like CAA can be trusted at all. Enable it if your DNS host signs and rolls keys automatically; remove the DS before you change DNS host.