A Python utility from IANA that fetches, cryptographically validates, and materializes the DNSSEC root zone KSK as DNSKEY and DS records for authorized operators and researchers.

Trust anchors are the cryptographic bedrock of DNSSEC: every validating resolver ultimately roots its chain of trust in the IANA-managed root zone Key Signing Key. get-trust-anchor, published by the iana-org organization on GitHub, is a small Python utility that solves a deceptively delicate operational problem — obtaining that root KSK in DNSKEY and DS record form while providing genuine cryptographic assurance that what you obtained is authentic. It is written in Python 3.10+ with only one external dependency, the OpenSSL command line tool, which keeps the supply-chain surface refreshingly small for something this sensitive.

What the tool actually does is a multi-stage verification pipeline rather than a simple downloader. First it fetches the trust anchor XML from iana.org over HTTPS, alongside a corresponding S/MIME signature. It then validates that signature against an ICANN Root CA certificate embedded in the tool itself. This design choice deserves attention: because the CA certificate ships inside the package, the authenticity of the trust anchors does not depend on whether HTTPS certificate checking succeeds during the fetch. Even a compromised or misconfigured TLS path cannot silently substitute a forged anchor, since the detached signature check will fail.

After signature validation, the tool extracts the trust anchor key digests from the XML and checks the validity period of each digest — an important detail during KSK rollovers, when multiple anchors may overlap in the file. It then fetches the live root KSK via the Google Public DNS HTTPS API, with a documented fallback to the canonical root zone file hosted at internic.net. Finally, it matches the fetched keys against the validated trust anchor digests before writing anything out. This cross-check between two independent sources — the signed IANA metadata and live DNS data — is the kind of defense-in-depth thinking security professionals should recognize and appreciate.

Installation is minimal. Cloning the repository and running pip install . provides a get-trust-anchor command, and the README also documents invocation as a Python module via python -m get_trust_anchor. By default the tool writes two files into the current directory: ksk-as-dnskey.txt containing the root KSKs as DNSKEY records, and ksk-as-ds.txt containing them as DS records. For scripting and automation pipelines, the --print-dnskey and --print-ds flags emit records to stdout instead, and the README shows a piping example filtering DS lines with grep "^. IN DS".

The option surface reveals the operational scenarios the authors anticipated. --local FILE and --local-sig FILE let you feed a previously downloaded trust anchor XML and signature rather than fetching live — useful in air-gapped environments or when auditing historical anchor files. --root-ca FILE allows substituting a custom CA certificate for the built-in ICANN one, which matters for organizations that need to manage their own pinning policies. --no-validation skips signature checking entirely, a convenience flag that should be used with full awareness that it discards the tool's core security property. --ksks-from-trust-anchor extracts keys directly from the XML instead of querying DNS, and --keep preserves the temporary XML and signature files for inspection after a run.

From a defensive and educational standpoint, this repository is valuable precisely because it documents, in working code, how trust anchor distribution is supposed to work. KSK rollovers — such as the historically delicate 2017 and 2018 events — are among the highest-stakes maintenance operations on the public internet, and misconfigured or stale anchors on validating resolvers can produce widespread false-negative validation, effectively breaking name resolution for users. Having a reproducible, signature-checked reference implementation that operators and auditors can run makes the anchor lifecycle auditable rather than folklore. Authorized operators can use it to seed or refresh trusted-keys and trust-anchors configuration stanzas on resolvers like Unbound or BIND in their own infrastructure.

The development section of the README signals a mature engineering posture. Tests run under pytest, code quality is enforced with ruff format, ruff check, and ty check, and releases are automated: pushing a v* tag triggers the release.yml GitHub workflow, which builds the sdist and wheel and attaches them to a GitHub Release. The licensing note is the only wrinkle — GitHub metadata reports NOASSERTION while the README states BSD 2-Clause under LICENSE, so anyone redistributing the tool should verify the file directly. The repository carries 113 stars and topic tags of dns, dnssec, and iana, consistent with a niche but genuinely authoritative infrastructure tool.

There is no offensive capability here, and that is worth stating plainly in a publication that usually covers attack tooling. get-trust-anchor sits at the opposite end of the spectrum: it is infrastructure hygiene, the kind of boring-but-critical component that determines whether the entire DNSSEC validation ecosystem fails or survives a key rollover. For red teamers it offers nothing; for blue teams, resolver operators, and DNS researchers it offers a canonical answer to the question of how to obtain a root trust anchor you can actually prove is genuine. Watching its release history also serves as a passive signal of upcoming rollover activity, since tool updates tend to accompany anchor lifecycle events.

In sum, get-trust-anchor is a compact, well-engineered utility that turns a manual, error-prone operational ritual into a verified, scriptable process. The embedded-CA signature validation, the dual-source key matching, and the clean output formats make it a model of how trust bootstrapping code should be written. For authorized professionals maintaining DNSSEC-validating infrastructure or studying how the root of the internet's trust hierarchy is distributed, it belongs in the toolbox.

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.

Related coverage

• broadcom-wps for detecting vulnerable Broadcom SDK access points in firmware and over the air


• Inside GoReSym: how Mandiant recovers symbols from stripped Go binaries


• CubeSandbox for isolating AI agent workloads in disposable containers