Plain DNS has no authentication: a resolver accepts the first plausible answer it receives, which makes cache poisoning possible. With DNSSEC the zone owner signs each record set with a private key. The signatures are published as RRSIG records and the public keys as DNSKEY records, and a validating resolver checks them before it uses an answer.
Trust is chained from the top. The parent zone publishes a DS record containing a hash of the child's key, the parent itself is signed and vouched for by its own parent, and the chain ends at the root zone, whose key resolvers are configured to trust. NSEC or NSEC3 records provide signed proof that a name does not exist.
DNSSEC provides authenticity and integrity, not privacy: queries and answers are still readable on the wire. It also needs care. If signatures expire, or the DS record at the registry no longer matches the key in the zone, validating resolvers return an error and the domain becomes unreachable for their users. That is the main reason to coordinate key changes and DNS provider moves carefully.
Example
example.com. 3600 IN RRSIG A 13 2 3600 20261020000000 20260920000000 12345 example.com. <signature>