A Signature Rides Beside the Record
A resolver receives an answer from a cache that has never talked to the authoritative server. What makes that answer trustworthy anyway?
Open Session 01Sessions
DNSSEC track sessions
The Key Signs the Key
A zone publishes two keys. Why two, and what exactly does each one sign?
Open Session 02DS Links Child to Parent
A resolver trusts the parent zone. The child zone hands it a KSK it has never seen before. What one fact lets the resolver decide to trust that key too?
Open Session 03Validation Walks Up the Tree
A signed answer arrives with an RRSIG attached. What exact sequence of checks turns that into SECURE, one of three flavors of BOGUS, or INSECURE — and why does the walk go up, not down?
Open Session 04Build the Toy Validating Resolver
What does the smallest object look like that can be handed a name, a type, and a signed answer, and say — with a full trace — whether that answer is provably correct, provably wrong, or provably absent of proof?
Open Session 05