Follow a chain of trust
02A validator starts with a configured trust anchor and follows authenticated delegations.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 2 ↗
RFC 4033 · § 2EXAMPLE
3 / 3
03
Use the authenticated child key to validate the child RRset.
Use the authenticated child key to validate the child RRset.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
A DS links a parent delegation to a child key; DNSKEY and signatures complete validation.
- A DS links a parent delegation to a child key; DNSKEY and signatures complete validation.
- An unsigned delegation and a bogus signed answer are different outcomes.
The drawing is a simplified worked example. Follow the linked RFC and its updates for implementation requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy