Hack the Route Start free Open app Encryption and trust
DNSSEC chain of trust
The run of signed links from the root's key, which a resolver trusts, down to the answer it checks.
Each record set carries an RRSIG, made with the zone's zone-signing key. The zone publishes its public keys as DNSKEY records, signed with its key-signing key; the parent zone publishes a DS, the digest of that key, signed with the parent's own keys; and so up to the root, whose key's digest the resolver is configured with: the trust anchor. A key changed without a new DS in the parent, or a stale trust anchor, breaks every name below it. A parent's signed proof that a child has no DS makes that child legitimately unsigned.