---
type: source
title: "DNSSEC Usage on macOS"
tags: [dnssec, macos, unbound, sshfp, security]
related: [dnssec, unbound, sshfp]
created: 2026-07-01
updated: 2026-07-01
authors: []
year: 2026
url: "https://rz.uni-greifswald.de/support/dokumentation/anleitungen/dnssec/macos"
venue: "Universitätsrechenzentrum (URZ) Documentation"
sources: ["output/rz_uni_greifswald_de_support_dokumentation_anleitungen_dnssec_macos.md"]
---

# DNSSEC Usage on macOS

This source provides a technical guide for implementing DNSSEC (DNS Security Extensions) on macOS to enable cryptographic validation of DNS responses and the use of SSHFP records for SSH host key verification.

## Key Technical Instructions

### Unbound DNS Resolver Setup
The guide recommends installing the `unbound` DNS resolver and the `ldns` library via Homebrew (`brew install unbound ldns`). 

**Security Configuration:**
- **Unprivileged Execution:** To limit security risks, the resolver should run under a dedicated user and group (`_unbound`). The guide provides `dscl` commands to create these entities using a free ID between 1-500.
- **Configuration:** The `unbound.conf` is configured to listen on `127.0.0.1` and forward requests to URZ DNS servers at `141.53.10.4` and `141.53.10.5`.
- **Trust Anchors:** A `root.key` file must be created containing the DS records for the DNS root zone to enable validation.
- **Persistence:** The service is configured to start automatically via a LaunchDaemon plist file at `/Library/LaunchDaemons/net.unbound.plist`.

### OpenSSH and SSHFP
The guide notes that the native macOS OpenSSH client cannot utilize SSHFP DNS entries due to its linked libraries. To use the `VerifyHostKeyDNS=yes` option, users must install a separate version of OpenSSH via Homebrew (`brew install openssh`).
