Using domain name system security extensions in a mixed-mode environment

A non-transitory machine-readable storage medium storing instructions which, when executed, cause a processing device to:

• transmit, by the processing device executing a domain name system (DNS) resolver, a first DNS query comprising a DNS request associated with an application to a first DNS server serving a first DNS zone connected to the processing device via a public network;
• receive, from the first DNS server, a first resource record comprising a DNS answer to the DNS query, a second resource record comprising a digital signature generated by signing the DNS answer with a first private key of the first DNS zone, a third resource record comprising a first public key to verify the digital signature, and one or more files to validate a chain of trust of the first public key, wherein the one or more files comprise a first file comprising a name of a second DNS server delegated by the first DNS server serving a second DNS zone;
• determine, by the processing device in view of the one or more files, that the chain of trust of the first public key misses at least one of a trust anchor or a link in the chain of trust;
• and
• transmit, by the DNS resolver, a second DNS query comprising the DNS request to a second DNS server residing in a private network of the processing device.

A system, comprising:

• a memory;
• and
• a processing device, communicatively coupled to the memory, to execute a domain name system (DNS) resolver to:
• transmit a first DNS query comprising a DNS request associated with an application to a first DNS server serving a first DNS zone;
• receive, from the first DNS server, a first resource record comprising a DNS answer to the DNS query, a second resource record comprising a digital signature generated by signing the DNS answer with a first private key of the first DNS zone, a third resource record comprising a first public key to verify the digital signature, and one or more files to validate a chain of trust of the first public key, wherein the one or more files comprise a first file comprising a name of a second DNS server delegated by the first DNS server serving a second DNS zone;
• determine, in view of the one or more files, that the chain of trust of the first public key misses at least one of a trust anchor or a link in the chain of trust;
• and
• transmit a second DNS query comprising the DNS request to a second DNS server residing in a private network of the processing device.