Signing a DNS zone is the process of generating digital signatures for the DNS records within that zone using DNSSEC.

During the signing process, DNSSEC-related records such as RRSIG, DNSKEY, and NSEC or NSEC3 records are generated and added to the zone. These records enable DNS resolvers to verify the authenticity and integrity of the DNS data.

The signing process is typically performed automatically by DNSSEC-enabled software, commonly referred to as a zone signer, running on the authoritative name server or DNS management platform.