How is a DNSSEC query formed?
A DNSSEC query is formed by a DNS resolver. Recent versions of BIND have already been forming DNSSEC queries but have not been reacting to the resulting DNSSEC responses. In order to react to the DNSSEC responses in a way that makes use of DNSSEC, resolvers need to be configured with a DNSSEC public key. Currently, resolvers of US domains will need to have the US DNSSEC public key when it is available. When the root zone is signed and fully functional, the root DNSSEC public key will be needed (instead).
