DNSSEC adds cryptographic signatures to DNS records. Resolvers can verify that records came from the authoritative source and weren't modified.
Each zone signs its records with a private key. The public key is published in DNS. Resolvers verify signatures using these public keys.
A chain of trust extends from root to TLD to your domain. If any signature fails verification, the resolver rejects the response.
DNSSEC prevents spoofing and cache poisoning but doesn't encrypt queries. DNS-over-HTTPS and DNS-over-TLS add encryption.