A DNSSEC key rollover is the process of replacing an existing cryptographic key with a new one. This may involve changing the Zone Signing Key (ZSK), the Key Signing Key (KSK), or both, to maintain the security and integrity of a DNSSEC-signed zone.
Key rollovers can occur for either planned or unplanned reasons:
- Planned rollovers are performed as part of routine key management practices, similar to periodically changing passwords or cryptographic certificates to reduce security risks.
- Unplanned rollovers are necessary when a key is suspected or confirmed to be compromised, or when personnel with access to the private key leave the organization or change roles.
During a key rollover, the DNS zone must be re-signed using the new key(s) to generate updated digital signatures (RRSIG records). If a KSK rollover is performed, the corresponding Delegation Signer (DS) record derived from the new KSK must be submitted to the parent zone (for .MY domain names, MYNIC) to maintain the DNSSEC chain of trust.
Failure to properly coordinate the rollover process, particularly the DS record update, may result in DNSSEC validation failures and cause the domain to become inaccessible to DNSSEC-validating resolvers.