ZSK
Zone Signing Key: the DNSSEC key used to sign all the resource record sets in a zone, rotated frequently.
A ZSK (Zone Signing Key) is the DNSSEC key that does the day-to-day signing of every record set in a zone, producing the RRSIG records that validating resolvers verify. ZSKs are typically smaller and shorter-lived than KSKs because rotating one does not require any coordination with the parent zone: just publish a new DNSKEY, re-sign with it, then retire the old one. Many operators run automated ZSK rollovers every 1 to 3 months. The split between KSK and ZSK lets operators have both strong long-term trust anchors and agile day-to-day key hygiene.