Unbound-anchor is a utility which securely fetches or updates the root DNS zone trust anchor. A copy of the current root anchor and root update certificate is embedded in unbound-anchor. RFC 5011 trust anchor tracking is performed, with fallback to an SSL fetch if this fails.