diff --git a/ndns/debian/validator.conf b/ndns/debian/validator.conf
new file mode 100644
index 0000000..e3f90e6
--- /dev/null
+++ b/ndns/debian/validator.conf
@@ -0,0 +1,28 @@
+rule
+{
+  id "NDNS Validator"
+  for data
+  checker
+  {
+    type customized
+    sig-type rsa-sha256
+    key-locator
+    {
+      type name
+      hyper-relation
+      {
+        k-regex ^(<>*)<KEY>(<>*)<><ID-CERT>$
+        k-expand \\1\\2
+        h-relation is-prefix-of ; data is only allowed to be signed by the zone key
+        p-regex ^(<>*)[<KEY><NDNS>](<>*)<><>$
+        p-expand \\1\\2
+      }
+    }
+  }
+}
+
+trust-anchor
+{
+  type file
+  file-name anchors/ndn-testbed-root.ndncert.base64
+}