A key rollover occurs whenever it is necessary to change the private key used to sign a zone or the public key used to validate a zone. This can occur for planned or unplanned reasons. Planned rollovers occur as an ordinary part of key management procedures, similar to changing a password on a regular basis. Unplanned rollovers occur whenever a key has been compromised or whenever a change of staff among those who have access to the private key.

This would also mean that a re-signing needs to be done and the new public key needs to be sent to the parent in the form of the Delegation Signer (DS) Record.