chain of trust

The linked series of DNSSEC signatures (glossary)RRSIG Resource Record Signature The DNS record that carries a DNSSEC signature for a set of records. Full definition of RRSIG that runs from the root zone (glossary)root zone The top of the DNS, listing every TLD and its name servers. Full definition of root zone down to a domain. Each parent zone holds a DS record (glossary)DS record Delegation Signer A record in the parent zone that links a domain's DNSSEC key to the chain of trust. Full definition of DS record that vouches for the child zone's key. If one link is missing or wrong, resolvers (glossary)resolver The DNS server that looks up domain names on behalf of users. Full definition of resolver that check signatures treat the domain's answers as invalid.