The zone is signed with a key, and each record set gets an RRSIG record. A DS record in the parent zone links your key into the chain of trust that starts at the root zone.
DNSSEC protects against cache poisoning and is a prerequisite for DANE (TLSA records for mail servers). It does not encrypt anything; queries stay readable.
The real risk is operational: expired signatures, or a DNS provider change that leaves the old DS record in place, make validating resolvers return no answer at all (SERVFAIL). Your domain then disappears for a large part of the internet.
Example
dig +dnssec example.com SOA