What is NTA?

An NTA (negative trust anchor) is a resolver setting that turns off DNSSEC validation for one domain and everything below it.

A validating resolver starts from a trust anchor, usually the root zone's key, and expects every answer to fit a valid chain of DS, DNSKEY and RRSIG records down from it. A negative trust anchor does the opposite of a trust anchor: for the configured name, the resolver skips validation and treats answers as insecure. It returns them normally, but never with the AD (authenticated data) flag. Everything outside that name is still fully validated. RFC 7646 describes NTAs as a temporary fix, for when another operator's DNSSEC mistake makes a popular domain fail and you need it working before they repair it. Resolvers support them in different ways: negative_trustanchors in the PowerDNS Recursor's configuration or rec_control add-nta at runtime, and rndc nta in BIND, which applies them with an expiry time.

A common permanent use is split DNS. Say example.net is signed in public DNS, and the office resolver forwards internal.example.net to internal servers with an unsigned zone. The resolver knows example.net is signed and no secure delegation for internal.example.net exists, so the internal answers look forged. Every query fails with SERVFAIL and Extended DNS Error 10, "RRSIGs Missing". An NTA for internal.example.net fixes it. Keep NTAs as narrow as possible and review them, because a forgotten NTA quietly leaves that domain without DNSSEC's protection. The PowerDNS on Debian lesson reproduces exactly this internal-zone failure and fixes it with an NTA.