diff -I '\$Id: ' -u -r -b -w -p -d --exclude-from=/home/rstory/.rcfiles/diff-ignore --new-file clean/lftp-4.0.2/configure.ac lftp-4.0.2/configure.ac
--- clean/lftp-4.0.2/configure.ac	2009-09-23 03:46:35.000000000 -0400
+++ lftp-4.0.2/configure.ac	2009-11-16 13:36:24.000000000 -0500
@@ -283,6 +283,32 @@ AC_CHECK_LIB(expat, XML_ParserCreateNS, 
    AC_DEFINE(HAVE_LIBEXPAT, 1, [Define if you have expat library])
 ])
 
+# Check whether user wants DNSSEC local validation support
+AC_ARG_WITH(dnssec-local-validation,
+        [  --with-dnssec-local-validation Enable local DNSSEC validation using libval (default=no)], want_dnssec=$withval, want_dnssec=no)
+if test "x$want_dnssec" = "xyes"; then
+    AC_CHECK_HEADERS(validator/validator.h)
+    if test "$ac_cv_header_validator_validator_h" != yes; then
+        AC_MSG_ERROR(Can't find validator.h (from dnssec-tools))
+    fi
+    AC_CHECK_LIB(ssl, SHA1_Init)
+    AC_CHECK_LIB(sres, query_send)
+    if test "$ac_cv_lib_sres_query_send" != yes; then
+        AC_MSG_ERROR(Can't find libsres (from dnssec-tools))
+    fi
+    AC_CHECK_LIB(val, p_val_status,[LIBS="$LIBS -lval"])
+    if test "x$ac_cv_lib_val_p_val_status" = "xno"; then
+        AC_CHECK_LIB(pthread, pthread_rwlock_init)
+	AC_CHECK_LIB(val-threads, p_val_status,
+                [LIBS="$LIBS -lval-threads -lpthread" LIBVAL_SUFFIX="-threads"],
+                AC_MSG_ERROR(Can't find libval or libval-threads (from dnssec-tools)))
+    fi
+    if test "x$ac_cv_lib_val_p_val_status" = "xyes" -o "x$ac_cv_lib_val_threads_p_val_status" = "xyes"; then
+        AC_DEFINE(DNSSEC_LOCAL_VALIDATION, 1,
+              [Define if you want local DNSSEC validation support])
+    fi
+fi
+
 LFTP_PTY_CHECK
 
 dnl Checks for header files.
diff -I '\$Id: ' -u -r -b -w -p -d --exclude-from=/home/rstory/.rcfiles/diff-ignore --new-file clean/lftp-4.0.2/src/Resolver.cc lftp-4.0.2/src/Resolver.cc
--- clean/lftp-4.0.2/src/Resolver.cc	2009-07-17 09:04:46.000000000 -0400
+++ lftp-4.0.2/src/Resolver.cc	2009-11-16 13:40:10.000000000 -0500
@@ -109,6 +109,12 @@ Resolver::Resolver(const char *h,const c
    error=0;
 
    no_cache=false;
+
+#ifdef DNSSEC_LOCAL_VALIDATION
+   if (VAL_NO_ERROR != val_create_context(NULL, &val_context)) {
+        val_log(NULL, LOG_ERR, "Cannot create validator context.");
+    }
+#endif
 }
 
 Resolver::~Resolver()
@@ -123,6 +129,13 @@ Resolver::~Resolver()
       w->Kill(SIGKILL);
       w.borrow()->Auto();
    }
+
+#ifdef DNSSEC_LOCAL_VALIDATION
+   val_free_context(val_context);
+
+   free_validator_state();
+#endif
+
 }
 
 int   Resolver::Do()
@@ -492,9 +505,22 @@ void Resolver::LookupSRV_RR()
 	    return;
       }
       time(&try_time);
+
+#ifndef DNSSEC_LOCAL_VALIDATION
       len=res_search(srv_name, C_IN, T_SRV, answer, sizeof(answer));
       if(len>=0)
 	 break;
+#else
+      val_status_t val_status;
+      int          require_trust = ResMgr::Query("dns:strict-dnssec",hostname);
+      len=val_res_search(val_context,srv_name, C_IN, T_SRV, answer, sizeof(answer), &val_status);
+      if(len>=0) {
+          if(require_trust && ! val_istrusted(val_status))
+              return;
+          else
+              break;
+      }
+#endif
 #ifdef HAVE_H_ERRNO
       if(h_errno!=TRY_AGAIN)
 	 return;
@@ -702,7 +728,22 @@ void Resolver::LookupOne(const char *nam
       a_hint.ai_flags	    = AI_PASSIVE;
       a_hint.ai_family	    = PF_UNSPEC;
 
+#ifndef DNSSEC_LOCAL_VALIDATION
       ainfo_res	= getaddrinfo(name, NULL, &a_hint, &ainfo);
+#else
+      val_status_t val_status;
+      int          require_trust=ResMgr::Query("dns:strict-dnssec",name);
+      ainfo_res	= val_getaddrinfo(val_context, name, NULL, &a_hint, &ainfo,
+                                  &val_status);
+      if((VAL_GETADDRINFO_HAS_STATUS(ainfo_res)) && ! val_istrusted(val_status) &&
+          require_trust)
+      {
+          // untrusted answer
+          error = _("DNS resolution not trusted.");
+          break;
+      }
+#endif
+
 
       if(ainfo_res == 0)
       {
diff -I '\$Id: ' -u -r -b -w -p -d --exclude-from=/home/rstory/.rcfiles/diff-ignore --new-file clean/lftp-4.0.2/src/Resolver.h lftp-4.0.2/src/Resolver.h
--- clean/lftp-4.0.2/src/Resolver.h	2009-07-17 09:04:46.000000000 -0400
+++ lftp-4.0.2/src/Resolver.h	2009-10-30 11:57:31.000000000 -0400
@@ -29,6 +29,10 @@
 #include "Cache.h"
 #include "network.h"
 
+#ifdef DNSSEC_LOCAL_VALIDATION
+#  include "validator/validator.h"
+#endif
+
 class Resolver : public SMTask, protected ProtoLog
 {
    xstring hostname;
@@ -63,6 +67,9 @@ class Resolver : public SMTask, protecte
    const char *error;
 
    static class ResolverCache *cache;
+#ifdef DNSSEC_LOCAL_VALIDATION
+   val_context_t *val_context;
+#endif
 
    bool no_cache;
    bool use_fork;
diff -I '\$Id: ' -u -r -b -w -p -d --exclude-from=/home/rstory/.rcfiles/diff-ignore --new-file clean/lftp-4.0.2/src/resource.cc lftp-4.0.2/src/resource.cc
--- clean/lftp-4.0.2/src/resource.cc	2009-03-17 06:59:59.000000000 -0400
+++ lftp-4.0.2/src/resource.cc	2009-10-20 14:47:30.000000000 -0400
@@ -325,6 +325,9 @@ static ResType lftp_vars[] = {
    {"dns:order",		 DEFAULT_ORDER, OrderValidate,0},
    {"dns:SRV-query",		 "no",	  ResMgr::BoolValidate,0},
    {"dns:use-fork",		 "yes",	  ResMgr::BoolValidate,ResMgr::NoClosure},
+#ifdef DNSSEC_LOCAL_VALIDATION
+   {"dns:strict-dnssec",	 "no",	  ResMgr::BoolValidate,0},
+#endif
 
    {"fish:shell",		 "/bin/sh",0,0},
    {"fish:connect-program",	 "ssh -a -x",0,0},
