How to locally validate DNSSEC?

Question

I want to simulate the process of chain of trust validation locally , I do the following :-

1) signed my zone.

2) unbound installed , but i can not configure it for DNSSEC validation could you help ?

• How can i set unbound to see and validate my zone.
• How to add my ds to server ?

How to set ad flag for dig queries ?

Answer 1

Partial answer, since I'm not familiar with unbound.

DS belongs on the server(s) delegating to your zone's servers, not on your zone's server(s). As you probably know, the content of a DS record is a hash of DNSKEY records in your zone. The DS is then signed by the parent zone, which by that verifies that it knows what (some of) your DNSKEYs look like.

The +adflag command line switch tells dig to set the AD bit in the query. However, setting that bit is the default, so you usually don't need to ask for it.

Answer 2

Not sure exactly what you need, but you can verify the chain of trust interactively at the terminal with dig +sigchase .