> it would need to have a recursive nameserver built in. But that's not the DNSSEC model. The DNSSEC model is to implicitly trust your resolver, which is usuall

> it would need to have a recursive nameserver built in. But that's not the DNSSEC model. The DNSSEC model is to implicitly trust your resolver, which is usually hosted remotely, accessed via an unauthenticated channel, and to ask it to perform the validation for you. If you do not wish your upstream resolver to do validation then set the CD flag - you will get an RR set that you can validate locally. dig +cd +qr +dnssec dnssec-failed.org @8.8.8.8 ... ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59002 ;; flags: qr rd ra cd; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1 ;; AUTHORITY SECTION: dnssec-failed.org. 1799 IN SOA dns101.comcast.org. dnsadmin.comcast.net. 2010101624 900 180 604800 7200 dnssec-failed.org. 21599 IN RRSIG SOA 5 2 86400 20140324165107 20140317134607 28833 dnssec-failed.org. R/stn+84i0qDGa7mMcJn00+/L1z/aj4kfCg1DiUPxokd8HK/FTwIfQcy 8oh+wsSFSYAvem3H3zZ8iVlwIHqmESEPwnkoGolI5BtnEPs7cT3kO1/i CA9DT18r4fdbJrXavWz5Z991gUOhfkpIPi1TmRC4/iZcNFwgBVhZsDEO uAc= dnssec-failed.org. 7199 IN NSEC www.dnssec- failed.org. NS SOA RRSIG NSEC DNSKEY dnssec-failed.org. 7199 IN RRSIG NSEC 5 2 7200 20140324165107 20140317134607 28833 dnssec-failed.org. P0s0825v9FxTYoLYqYrJMLmqfuiDvBOGhYbT2ZmypZN1GKwWfEX7TaoJ TE5RB70HNUWFE4Moi+hfRP9wye61tupT75p7Szqn53pBQ58kO73YiYiz MBWB1RreRABRbSwInvWNR9DNsVwBr/6z6/h3fDpGz5O+m8+E64xWv2T8 OgE=