← Back to Labs

DNSSEC Validation Path

Trace the root trust anchor, parent DS, child DNSKEY, RRset signatures, and denial proofs that decide whether a resolver sets AD or rejects the answer.

Failure mode

All DS, DNSKEY, RRSIG, and denial proofs line up cleanly.

Root trust anchor. DNSKEY KSKlocal validator stateParent DSexample.eu DSdigest type 2Child DNSKEYKSK 257 + ZSK 256DNSKEY RRset + RRSIGAnswer RRsetwww.example.eu A / AAAARRSIG checked with ZSKNegative proofNSEC or NSEC3NXDOMAIN / NODATA proofResolver resultTrust anchor loadedsecure / AD possibleDNSSEC has to begin outside DNS itself, so validators pin a root trust anchor locally.
Step 1 / 6The resolver starts with a root trust anchor

The resolver cannot discover trust from nowhere. It begins with a root key it already trusts and uses that as the first secure starting point.

Current result

Trust anchor loaded

The resolver starts from a current root trust anchor, so it has a known-good root of trust.

Arrow keys to navigate · R to reset

Tap dots to jump to any step

Read the full article →Take the quiz →