<!DOCTYPE html>
<html>
<head>
<title></title>
</head>
<body><div><br></div>
<div>Emil Natan <e@foowatch.com> wrote:<br></div>
<div>><br></div>
<div>> I'm looking for DNSSEC validation tool/library (ideally PHP/Python/shell)<br></div>
<div>> which can perform validation on a DNSKEY record using trust anchor<br></div>
<div>> provided as DS record.<br></div>
<div><br></div>
<div>This probably doesn't solve enough of your problem, but you can use BIND's dnssec-dsfromkey or ldns's key2ds programs. Convert each KSK to a DS using either of these programs, and check that one matches the DS from the parent zone.<br></div>
<div><br></div>
<div id="sig49431681"><div class="signature">Tony.<br></div>
<div class="signature">--<br></div>
<div class="signature">f.anthony.n.finch <dot@dotat.at> http://dotat.at/ - I xn--zr8h punycode<br></div>
<div class="signature"><br></div>
</div>
<div><br></div>
</body>
</html>