DNSSEC-TRUST-ANCHORS.D(5) dnssec-trust-anchors.d DNSSEC-TRUST-ANCHORS.D(5) dnssec-trust-anchors.d systemd.positive systemd.negative - DNSSEC /etc/dnssec-trust-anchors.d/*.positive /run/dnssec-trust-anchors.d/*.positive /usr/local/lib/dnssec-trust-anchors.d/*.positive /usr/lib/dnssec-trust-anchors.d/*.positive /etc/dnssec-trust-anchors.d/*.negative /run/dnssec-trust-anchors.d/*.negative /usr/local/lib/dnssec-trust-anchors.d/*.negative /usr/lib/dnssec-trust-anchors.d/*.negative DNSSEC systemd-resolved.service(8) DNSSEC. DNSKEY DS DNSSEC. RFC 4035 4.4[1] DNSSEC. .positive /etc/dnssec-trust-anchors.d/ /run/dnssec-trust-anchors.d/ /usr/lib/dnssec-trust-anchors.d/. . /usr/lib/dnssec-trust-anchors.d/ /etc/dnssec-trust-anchors.d/ /run/dnssec-trust-anchors.d/ /dev/null (""). DNS RFC 1035 5[2]. DS DNSKEY . "#" ";" . DS : . IN DS 19036 8 2 49aac11d7b6f6446702e54a1607371607a1a41855200fd2ce1cdde32f24e8fb5 "." . . "IN" "DS". . RFC 4034 5[3] . DNSKEY : . IN DNSKEY 257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjFFVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoXbfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaDX6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpzW5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relSQageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulqQxA+Uk1ihz0= "IN" "DNSKEY". DNSKEY Base64. RFC 4034 2[4] . DS DNSKEY ( ) DNSSEC. systemd-resolved . . . DS DNSKEY. DS . RFC 5011[5] . systemd-resolved DNS . . DNSSEC IANA[6]. DNSSEC . . .negative. ";". DNS . : # Reverse IPv4 mappings 10.in-addr.arpa 16.172.in-addr.arpa 168.192.in-addr.arpa ... # Some custom domains prod stag (DNS) . RFC 7646[7] . . DNSSECNegativeTrustAnchors= systemd.network(5). systemd(1) systemd-resolved.service(8) resolved.conf(5) systemd.network(5) 1. RFC 4035 4.4 https://tools.ietf.org/html/rfc4035#section-4.4 2. RFC 1035 5 https://tools.ietf.org/html/rfc1035#section-5 3. RFC 4034 5 https://tools.ietf.org/html/rfc4034#section-5 4. RFC 4034 2 https://tools.ietf.org/html/rfc4034#section-2 5. RFC 5011 https://tools.ietf.org/html/rfc5011 6. IANA https://data.iana.org/root-anchors/root-anchors.xml 7. RFC 7646 https://tools.ietf.org/html/rfc7646 3 . . : . systemd 260.2 DNSSEC-TRUST-ANCHORS.D(5)