DNSSEC

DNSSEC adds signatures to DNS. When a resolver asks where example.com lives, the answer comes back signed with a key that chains up to the registry and the root, so a forged answer from someone sitting on the network gets rejected instead of trusted.

You turn it on at your DNS provider and then register the key with your registrar, which passes it to the registry as a DS record. Most large registrars and DNS providers support it, and a lot of them do it with one click.

The practical note for domain owners is about transfers and DNS changes. If DNSSEC is enabled and you move the domain to a new DNS provider without updating or removing the DS record, the domain stops resolving everywhere until you fix it. Turn it off before a move, or make sure the new provider's keys go in at the same time.