<div class="content" name="DNS_RPC_TRUST_ANCHOR" uuid="3ac97d1e-7f7b-4cd3-aa24-ccbde00ef0be"><p>The <b>DNS_RPC_TRUST_ANCHOR</b> structure contains
information about a trust anchor.</p><dl>
<dd>
<div><pre> typedef struct _DnssrvRpcTrustAnchor {
   DWORD dwRpcStructureVersion;
   DWORD dwReserved0;
   WORD wTrustAnchorType;
   WORD wKeyTag;
   WORD wRRLength;
   TRUSTANCHOR_STATE eTrustAnchorState;
   __int64 i64EnteredStateTime;
   __int64 i64NextStateTime;
   DWORD dwReserved;
   [size_is(wRRLength)] BYTE RRData[];
 } DNS_RPC_TRUST_ANCHOR,
  *PDNS_RPC_TRUST_ANCHOR;
</pre></div>
</dd></dl><p><b>dwRpcStructureVersion:</b> The structure
version number; this MUST be set to 0x00000001.</p><p><b>dwReserved0:</b> MUST be set to zero when
sent and MUST be ignored on receipt.</p><p><b>wTrustAnchorType:</b> The DNS record type
corresponding to the trust anchor. This MUST be set to one of the following
values.</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>DNS_TYPE_DS 0x002B</td>
  <td>A DS record type [RFC4034].</td>
 </tr><tr>
  <td>DNS_TYPE_DNSKEY 0x0030</td>
  <td>A DNSKEY record type [RFC4034].</td>
 </tr></tbody></table>
</dd></dl><p><b>wKeyTag:</b> The DNSSEC key tag for this
trust anchor. The key tag for a DS record trust anchor MUST match the value of
the record’s &#34;Key Tag&#34; field (see [RFC4034]). The key tag for a
DNSKEY record trust anchor MUST match the value calculated for the DNSKEY record
(see [RFC4034] Appendix B), with the exception that the REVOKE bit of the
DNSKEY flags field MUST be set to zero before the calculation.</p><p><b>wRRLength:</b> The length of the <b>RRData</b>
array.</p><p><b>eTrustAnchorState:</b> The current state of
the trust anchor. This MUST be one of the following <b>TRUSTANCHOR_STATE</b>
enumeration values (section <span><a href="d84d1ece-610a-4911-8cfc-8f93bc9a870e" data-linktype="relative-path">2.2.1.1.4</a></span>).</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>TRUSTANCHOR_STATE_DSPENDING 0x00000001</td>
  <td>This trust anchor can be replaced with a matching DNSKEY trust anchor when the associated trust point  has had a successful active refresh. If this state is set, wTrustAnchorType MUST be DNS_TYPE_DS.</td>
 </tr><tr>
  <td>TRUSTANCHOR_STATE_DSINVALID 0x00000002</td>
  <td>The associated trust point has had a successful active refresh, but no DNSKEY record was found that matches this trust anchor. If this state is set, wTrustAnchorType MUST be DNS_TYPE_DS.</td>
 </tr><tr>
  <td>TRUSTANCHOR_STATE_ADDPEND 0x00000003</td>
  <td>This trust anchor will become valid after the expiration of the RFC 5011 add hold-down time (see [RFC5011]). This corresponds to the &#34;AddPend&#34; state in RFC 5011.</td>
 </tr><tr>
  <td>TRUSTANCHOR_STATE_VALID 0x00000004</td>
  <td>This trust anchor is trusted for DNSSEC proofs because it was either explicitly added by the administrator or became valid after the expiration of the RFC 5011 add hold-down time (see [RFC5011]). This corresponds to the Valid state in RFC 5011.</td>
 </tr><tr>
  <td>TRUSTANCHOR_STATE_MISSING 0x00000005</td>
  <td>This trust anchor was in the TRUSTANCHOR_STATE_VALID state but was missing in the last successful active refresh. It is still trusted for DNSSEC proofs. This corresponds to the Valid state in [RFC5011].</td>
 </tr><tr>
  <td>TRUSTANCHOR_STATE_REVOKED 0x00000006</td>
  <td>This trust anchor has been marked as revoked by the administrator for the trust point&#39;s zone. It can never again be trusted for DNSSEC proofs. This corresponds to the Revoked state in [RFC5011].</td>
 </tr></tbody></table>
</dd></dl><p><b>i64EnteredStateTime:</b> The time at which
this trust anchor entered its current state. This is a 64-bit value
representing the number of 100-nanosecond intervals since January 1, 1601
(UTC).</p><p><b>i64NextStateTime:</b> The time at which this
trust anchor is scheduled to exit the current state. This is a 64-bit value
representing the number of 100-nanosecond intervals since January 1, 1601
(UTC). The meaning is dependent on the value of <b>eTrustAnchorState</b>.</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value of eTrustAnchorState</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>TRUSTANCHOR_STATE_DSPENDING 0x00000001</td>
  <td>Reserved. The value of i64NextStateTime MUST be set to zero when sent and MUST be ignored on receipt.</td>
 </tr><tr>
  <td>TRUSTANCHOR_STATE_DSINVALID 0x00000002</td>
  <td>Reserved. The value of i64NextStateTime MUST be set to zero when sent and MUST be ignored on receipt.</td>
 </tr><tr>
  <td>TRUSTANCHOR_STATE_ADDPEND 0x00000003</td>
  <td>This trust anchor is scheduled to enter the TRUSTANCHOR_STATE_VALID state on or after the value of i64NextStateTime. This MUST be equivalent to the value of i64EnteredStateTime added to the value of the add hold-down time (see [RFC5011]).</td>
 </tr><tr>
  <td>TRUSTANCHOR_STATE_VALID 0x00000004</td>
  <td>Reserved. The value of i64NextStateTime MUST be set to zero when sent and MUST be ignored on receipt.</td>
 </tr><tr>
  <td>TRUSTANCHOR_STATE_MISSING 0x00000005</td>
  <td>Reserved. The value of i64NextStateTime MUST be set to zero when sent and MUST be ignored on receipt.</td>
 </tr><tr>
  <td>TRUSTANCHOR_STATE_REVOKED 0x00000006</td>
  <td>This trust anchor will become eligible for deletion on or after the value of i64NextStateTime. This MUST be equivalent to the value of i64EnteredStateTime added to the value of the remove hold-down time (see [RFC5011]).</td>
 </tr></tbody></table>
</dd></dl><p><b>dwReserved:</b> MUST be set to zero when sent
and MUST be ignored on receipt.</p><p><b>RRData:</b> Binary data in the same format as
<span><a href="a9d25f06-22b8-468c-944a-5ec60a801a45" data-linktype="relative-path">DNS_RPC_RECORD_DNSKEY (section 2.2.2.2.4.15)</a></span>
if <b>wTrustAnchorType</b> is DNS_TYPE_DNSKEY, or binary data in the same
format as <span><a href="ea58fdc5-daae-4156-9a00-c76a9062b060" data-linktype="relative-path">DNS_RPC_RECORD_DS (section 2.2.2.2.4.12)</a></span>
if <b>wTrustAnchorType</b> is DNS_TYPE_DS.</p></div>