- A DNSSEC key is a cryptographic key used in Domain Name System Security Extensions (DNSSEC) to digitally sign and validate DNS data. It ensures that DNS responses are authentic and have not been altered during transmission.Types of DNSSEC Keys:1. Key Signing Key (KSK)
- Used to sign the DNSKEY record set in a DNS zone.
- Serves as the trust anchor for the zone.
- Usually has a longer key length and is changed less frequently.
- The hash of the KSK is published as a DS (Delegation Signer) record in the parent zone.
2. Zone Signing Key (ZSK)- Used to sign all other DNS records in the zone (A, AAAA, MX, NS, TXT, etc.).
- Typically rolled over more frequently than the KSK.
- The public part of the ZSK is published in the DNSKEY record set.
Knowledge Base