> You are assuming that your client OS/browser DNS resolvers have the pre-shared trust anchors for whichever root zone. That's kind of a big assumption. First:

> You are assuming that your client OS/browser DNS resolvers have the pre-shared trust anchors for whichever root zone. That's kind of a big assumption. First: There are two arguments to be had. One is the server side, and one is the browser side. The server is going to know about the key problem if it happens. The client side browser can know, if the client is using plugins like this one: https://www.dnssec-validator.cz/ https://www.dnssec-validator.cz/ Second: Here is the root key: https://www.iana.org/dnssec/files https://www.iana.org/dnssec/files