DNSSEC

Signatures on DNS records, validated from the root down, so a resolver can tell a forged answer from a real one. Needs a DS record in the parent zone.