L (ell) root server began serving a Deliberately Unvalidatable Root Zone (DURZ). The zone uses signatures of a SHA-2 (SHA-256) hash created using the RSA algorithm, as defined in RFC 5702. As of May 2010, all thirteen root servers have begun serving the DURZ. On July 15, 2010, the first root full production DNSSEC root zone was signed, with the SOA serial 2010071501. Root trust anchors are available from IANA. Deployment at the TLD level Underneath the root there is a large set of top-level domains that must be signed in order to achieve full DNSSEC deployment. The List of Internet top-level domains provides details about which of the existing top-level domains have been signed and linked to the root. DNSSEC Lookaside Validation - historical In March 2006, the Internet Systems Consortium introduced the DNSSEC Lookaside Validation registry. DLV was intended to make DNSSEC easier to deploy in the absence of a root trust anchor. At the time it was imagined that a validator might have to maintain large numbers of trust anchors corresponding to signed subtrees of the DNS. The purpose of DLV was to allow validators to offload the effort of managing a trust anchor repository to a trusted third party. The DLV registry maintained a central list of trust anchors, instead of each validator repeating the work of maintaining its own list. To use DLV, a validator that supports it was needed, such as BIND or Unbound, configured with a trust anchor for a DLV zone. This zone contained DLV records; these had exactly the same format as DS records, but instead of referring to a delegated sub-zone, they referred to a zone elsewhere in the DNS tree. When the validator could not find a chain of trust from the root to the RRset it is trying to check, it searched for a DLV record that could provide an alternative chain of trust. Gaps in the chain of trust, such as unsigned top-level domains or registrars that did not support DNSSEC delegations, meant administrators of lower-level domains could use DLV to allow their DNS data to be validated by resolvers which had been configured to use DLV. This may have hindered DNSSEC deployment by taking pressure off registrars and TLD registries to properly support DNSSEC. DLV also added complexity by adding more actors and code paths for DNSSEC validation. ISC decommissioned its DLV registry in 2017. DLV