Glossary
DNSSEC
DNSKEY
A public key published in the zone. Conventionally split into a key-signing key, which signs the DNSKEY set and is what the parent commits to, and a zone-signing key, which signs everything else.
Defined in RFC 4034 §2.
Where this appears
The lessons that use this term, and what each is for.
Domain Security FundamentalsDNSKEY, RRSIG, DS and NSECIdentify each DNSSEC record type in a real answer and say what job it does.DNS Security PractitionerOne key or twoRead a zone’s DNSKEY set and say which signing arrangement it uses and why.DNS Security PractitionerWhich algorithmChoose a signing algorithm for a new zone, and name what to migrate off.DNS Security PractitionerThe rollover that breaks delegationsPerform a KSK rollover in an order that never leaves the parent pointing at nothing.DNS Security PractitionerRolling the signing keyChoose between pre-publish and double-signature, and say what each costs.DNS Security PractitionerLetting the parent update itselfPublish CDS and CDNSKEY so a rollover needs no registrar interaction.DNS Security PractitionerRunning twoSay what must stay synchronised across two providers, and what DNSSEC adds to that.