You can make your DNS server ignore root certificate and use anchors stored locally for specific TLD.<p>If then you contact a TLD that&#x27;s owned by 3rd party you essentially trusting whoever owns that TLD. For example .google is owned by Google, so whatever is under it is under their full control.