DNSSEC
DNSSEC (Domain Name System Security Extensions) adds cryptographic signatures to [[dns|DNS]] records, allowing resolvers to verify that responses haven't been tampered with. DNSSEC prevents cache poisoning and man-in-the-middle attacks on DNS lookups.
Example
With DNSSEC enabled, your browser can verify that the IP address returned for your-bank.com actually came from the authoritative DNS server.
Referenced in Guides
DNS Configuration