DNSKEY record
A DNSKEY record publishes the public key a zone uses to sign its own DNS records under DNSSEC, defined alongside the rest of the DNSSEC record set in RFC 4034. A zone's authoritative servers hold the matching private key and use it to generate RRSIG records -- the actual signatures over other record sets -- while a validating resolver fetches the DNSKEY record to verify those signatures, and separately checks a DS record at the parent zone to confirm the DNSKEY itself hasn't been substituted by an attacker. A zone typically publishes two: a Zone Signing Key used for day-to-day signing, and a Key Signing Key that signs the DNSKEY record set itself and is the one hashed into the parent's DS record. Losing track of a key rollover here is a common way a signed zone goes dark for validating resolvers.
By AdminKit team, Netbase JSC · Updated