# man > dnssec-trust-anchors.d(5)

---
type: CommandReference
command: dnssec-trust-anchors.d
mode: man
section: 5
source: man-pages
---

## Quick Reference

- Place positive trust anchor files (`*.positive`) in `/etc/dnssec-trust-anchors.d/`, `/run/dnssec-trust-anchors.d/`, or `/usr/lib/dnssec-trust-anchors.d/`
- Place negative trust anchor files (`*.negative`) in the same directories
- Files in `/etc` override `/run`, which override `/usr/lib`; mask a file by making it empty or a symlink to `/dev/null`
- Positive trust anchors use `DS` or `DNSKEY` resource records in zone file format
- Negative trust anchors list domain names (one per line) where DNSSEC validation is disabled
- Default root domain trust anchor is built-in; explicit root keys disable it
- Built-in negative trust anchors for private zones are used if no negative files exist
- Per-interface negative trust anchors can be set via `_DNSSECNegativeTrustAnchors=` in `systemd.network(5)`

## Name

`dnssec-trust-anchors.d`, `systemd.positive`, `systemd.negative` — DNSSEC trust anchor configuration files

## Synopsis

`/etc/dnssec-trust-anchors.d/*.positive`  
`/run/dnssec-trust-anchors.d/*.positive`  
`/usr/lib/dnssec-trust-anchors.d/*.positive`  
`/etc/dnssec-trust-anchors.d/*.negative`  
`/run/dnssec-trust-anchors.d/*.negative`  
`/usr/lib/dnssec-trust-anchors.d/*.negative`

## Options

### Positive Trust Anchors

- **DS record format**: `domain IN DS key-tag algorithm digest-algorithm hex-fingerprint`
- **DNSKEY record format**: `domain IN DNSKEY flags protocol algorithm base64-key-data`
- Domain may be with or without trailing dot; use `.` for root
- Empty lines and lines starting with `#` or `;` are ignored
- Multiple `DS` or `DNSKEY` records for the same domain are combined
- Built-in root trust anchor is disabled when any root domain key is defined in files
- Revoked trust anchors (per RFC 5011) are automatically removed at runtime
- Updates to trust anchors require updating the resolver software or adding new files

### Negative Trust Anchors

- Each line specifies one domain name where DNSSEC validation is disabled
- Empty lines and lines starting with `;` are ignored
- Useful for private DNS subtrees not signed
- If no negative trust anchor files exist, a built-in set of private DNS zone domains is used
- Per-interface negative trust anchors can be defined via `_DNSSECNegativeTrustAnchors=` in `systemd.network(5)`

## Examples

shell
# Positive trust anchor using DS record (root domain)
. IN DS 19036 8 2 49aac11d7b6f6446702e54a1607371607a1a41855200fd2ce1cdde32f24e8fb5
shell
# Positive trust anchor using DNSKEY record (root domain)
. IN DNSKEY 257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjFFVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoXbfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaDX6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpzW5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relSQageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulqQxA+Uk1ihz0=
shell
# Negative trust anchor file example
# Reverse IPv4 mappings
10.in-addr.arpa
16.172.in-addr.arpa
168.192.in-addr.arpa
# Some custom domains
prod
stag
## See Also

- [systemd(1)](http://localhost/phpMan.php/man/systemd/1/markdown)
- [systemd-resolved.service(8)](http://localhost/phpMan.php/man/systemd-resolved.service/8/markdown)
- [resolved.conf(5)](http://localhost/phpMan.php/man/resolved.conf/5/markdown)
- [systemd.network(5)](http://localhost/phpMan.php/man/systemd.network/5/markdown)
- RFC 4035 Section 4.4 (https://tools.ietf.org/html/rfc4035#section-4.4)
- RFC 1035 Section 5 (https://tools.ietf.org/html/rfc1035#section-5)
- RFC 4034 Section 5 (https://tools.ietf.org/html/rfc4034#section-5)
- RFC 4034 Section 2 (https://tools.ietf.org/html/rfc4034#section-2)
- RFC 5011 (https://tools.ietf.org/html/rfc5011)
- IANA Trust Anchor and Keys (https://data.iana.org/root-anchors/root-anchors.xml)
- RFC 7646 (https://tools.ietf.org/html/rfc7646)