[http://www.nlnetlabs.nl/projects/ldns/ ldns], [https://www.dnssec-tools.org/ DNSSEC-Tools], and [http://unbound.net/download.html Unbound] all use BSD licenses. Thus far, I've had the most success using ldns. Unbound uses ldns.
Most likely, any DNSSEC library will use openssl. So, if that library is included in Firefox, either openssl will have to be included as well or the library will have to be modified to use nss.
== Creating a TLSA Record ==