Donate
‹ Back
Domain Name System Security Extensions (DNSSEC) 5 January 2012

DNSSEC-Trigger

DNSSEC-Trigger from NLnet Labs is a fascinating experimental tool that solves a fundamental problem that many end-users do not have access to a local DNS resolver that supports DNSSEC.  DNSSEC-Trigger configures a local copy of the Unbound DNS server (supplied for both Windows and Mac OS X) on your laptop or desktop so that you can use DNSSEC validation even if your local DNS servers may not directly support it.  As the project page explains:

Dnssec trigger enables the end-host (laptop or desktop computer) to use DNSSEC protection for the DNS traffic.  It probes for DNSSEC capable servers and instructs a validator on localhost to use that. If it fails, the user can opt to go insecure.

This means a browser can (often) get DNSSEC capable results. It may trust results from 127.0.0.1 with the ADflag. Or it can do DNSSEC validation itself.

As this is a very useful component for testing DNSSEC, we intend to link to (or create) some tutorials relating to installing and using DNSSEC-Trigger. (If you are aware of existing tutorials, HOWTOs or blog posts, please let us know.)

‹ Back

Related articles

Plan - Where We Need To Get DNSSEC Validation Happening
Domain Name System Security Extensions (DNSSEC)2 May 2014

Plan – Where We Need To Get DNSSEC Validation Happening

For DNSSEC to succeed, we need to get DNSSEC validation happening within DNS resolvers at many different levels within the...

Deployment Guide: DNSSEC for Internet Service Providers (ISPs)
Deploy36011 November 2013

Deployment Guide: DNSSEC for Internet Service Providers (ISPs)

An Internet Service Provider needs to offer high value while containing costs. One way to increase your services' value is...

The Two Sides of DNSSEC – Signing and Validation
Domain Name System Security Extensions (DNSSEC)5 August 2014

The Two Sides of DNSSEC – Signing and Validation

There are two sides of DNSSEC, Signing and Validation, that together provide the increased level of security offered by DNSSEC...

Join the conversation with Internet Society members around the world