We've seen that the DS record allows a parent to verify a child. But this creates a recursive question: Who verifies the parent? The answer is a 'Chain of Trust' that starts at the very top of the DNS hierarchy: The Root Zone.
At the top of the pyramid is the Root Zone (the `.` domain). The public key for the Root Zone is called the 'Root Trust Anchor'. This key is not verified by another record—it is manually hardcoded into every DNS resolver in the world (e.g., inside BIND or Unbound software).
💡 If you don't have the Root Trust Anchor, you cannot verify any DNSSEC record on the entire internet, because the chain has no starting point.
Once the resolver trusts the Root, the process becomes a series of delegations: 1. Root verifies the `.com` TLD via a DS record. 2. The `.com` TLD verifies `google.com` via a DS record. 3. `google.com` verifies the `www` record via an RRSIG.
Think of it as a series of nested envelopes. You trust the outer envelope (Root). Inside is a note saying 'I trust the person who wrote the next envelope' (TLD). Inside that is a note saying 'I trust the person who wrote the final letter' (Authoritative Zone). If any seal is broken, the whole chain is void.
A single mistake in the TLD's DS record can cause an entire country's TLD (e.g., `.uk` or `.jp`) to appear 'Bogus' to the world, effectively deleting thousands of websites from the internet for validating users.
| Level | Trust Source | Verification Record | Managed By |
|---|---|---|---|
| Root (.) | Hardcoded Anchor | DNSKEY | ICANN / IANA |
| TLD (.com, .org) | Root Zone | DS Record | Registry (e.g. Verisign) |
| Domain (example.com) | TLD Zone | DS Record | Domain Owner |
| Subdomain (www) | Domain Zone | RRSIG | Domain Owner |
What happens if a domain is signed with DNSSEC, but the parent TLD does not support it or refuses to publish the DS record? This creates an 'Island of Trust'. The records are signed, but there is no chain connecting them to the Root. A validating resolver will treat these records as unsigned, and the security benefits are lost.
Manually updating the Root Trust Anchor is a high-risk operation. If you enter the wrong key, your resolver will mark every single DNSSEC-signed site on the web as 'Bogus'.
Verify exercises to earn ★ 150 XP and unlock next lab level.