NameSurfer Suite
DLV records
FusionLayer
HELP
  Table of contents
   Exit help

NameSurfer 7.6.4.1


DLV (DNSSEC Lookaside Validation) records are used to establish a chain of trust using trust anchors outside of the DNS delegation chain, allowing verification of DNSSEC signed zone data when a full security chain from the root zone up to a leaf zone is not available.

The DLV record's format is identical to the DS record, which is used to form the chain of trust from a parent zone to a child zone. The difference between the DS and the DLV is that the latter is stored in a zone outside the delegation chain itself, and is accessed by a specially designated query directed to a DLV service.

The DLV record consists of the key identifier tag calculated for the key it identifies, security algorithm identifier of the key, hash algorithm identifier of the DLV record itself and a digest value (hexadecimal string) of the originating DNSKEY created using the hash algorithm.