DS e catena di fiducia

DS and the chain of trust

A DS record in a parent zone links a child’s name to one of the child’s DNSKEYs. The validator starts from a trusted key, checks signatures in the parent, follows the DS link to the child key, and then validates the child’s signed RRsets.

trust anchor → DS del parent → DNSKEY del child → RRSIG del record

A DS that does not match a child DNSKEY breaks the chain. A child with no DS is not automatically false; that branch may be insecure because it is not delegated as DNSSEC-secure. If the chain says to validate but the proof fails, the data is bogus and a resolver may return SERVFAIL.

Check your understanding

Choose the best answer. This quiz runs locally and sends no DNS queries to real domains.