I want to establish trust in a DNSSEC record. I found, that it can be done

$ dig +sigchase +trusted-key=./root.key @ eesti.ee

root.key could be obtained with

$ dig . DNSKEY @ | grep -Ev '^($|;)' > root.keys

however, this would be insecure and suspectible to mitm attacks.

I believe that IANA publishes the root key on https://www.iana.org/dnssec/files (where it is signed with HTTPS, PGP, etc.), but it is in XML format and I failed to use it with dig.

How to convert it from XML to same format as root.keys ?


You can download the Root Zone file on the IANA website (HTTPS). This file contains the root keys you need. You can use grep to get the DNSKEY.

$ curl -s https://www.internic.net/domain/root.zone | grep "^\.\s\+[0-9]\+\s\+IN\s\+DNSKEY" > root.keys

$ dig +sigchase +trusted-key=./root.keys @ eesti.ee

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.