Is the public DNSKEY of the DNS root zone that I have to trust when validating a DNSSEC key chain usually bundled with an OS? If so where is it located under Ubuntu 15.04, Linux?

What is otherwise the method to obtain it, that is considered "safe"?

I am using dig +nocomments +nostats +nocmd +noquestion -t dnskey . > trusted-key.key at the moment but I'd be interested in what the theoretically preferred solution of obtaining it would be.


apt-get install dns-root-data works on Ubuntu, at least in 16.04 and up. It also works on recent Debian.


This resource should be useful too: IANA DNSSEC files. Note that there is a root key change planned for 2017.

A safe way is to use HTTPS to retrieve it and to check the server certificate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.