DNSKEY

A DNSKEY record publishes the public half of a DNSSEC signing key in the zone. A typical signed zone has at least two DNSKEYs: a ZSK (Zone Signing Key) used to sign every record set, and a KSK (Key Signing Key) used only to sign the DNSKEY set itself. Validating resolvers fetch the DNSKEY records, then use them to verify the RRSIG signatures on other records. The hash of the KSK is also published in the parent zone as a DS record, which is what extends the chain of trust upward. DNSKEY rollovers are one of the trickiest operational tasks in DNSSEC.