What Are the Types of DNSSEC Keys?
Last updated
DNSSEC uses two types of keys. The Zone Signing Key (ZSK) signs your domain’s DNS records, and the Key Signing Key (KSK) signs the set of DNSKEY records and is referenced by the DS record in your parent zone. When you enable DNSSEC at DNSimple, we create both keys for you.
Zone Signing Key (ZSK)
The Zone Signing Key is used to sign your domain’s DNS records, like A, MX, and CNAME records.
This allows DNS resolvers to check that your DNS information hasn’t been tampered with and is coming from the correct source.
Key Signing Key (KSK)
The Key Signing Key signs your DNSKEY record, which contains the public part of both your ZSK and KSK.
This signature allows DNS resolvers to verify that the keys protecting your domain can be trusted.
It also connects your domain to the global DNSSEC chain of trust:
- Your domain’s parent zone (like .com, .org, etc.) stores a DS record that points to your KSK.
- When a DNS resolver looks up your domain, it first checks this DS record to confirm it can trust your KSK.
- Once the resolver trusts your KSK, it can then trust your ZSK and, in turn, trust your DNS records.
Why DNSSEC uses two keys
Splitting the work between two keys keeps the link to the parent zone separate from everyday signing. Only the KSK is tied to the DS record at your registrar, so the ZSK, which signs every record in your zone, can be changed without touching the parent zone.
DNSSEC keys at DNSimple
- Both keys use algorithm 8 (RSA/SHA-256).
- Both keys are published in your zone as DNSKEY records, which are system records you can’t edit.
- DNSimple rotates the keys automatically. Because the KSK changes during rotation, the DS record at the parent zone changes too.
Learn more
To learn more about DNSSEC, see What Is DNSSEC?. To understand how DS records connect your KSK to the parent zone, see What Are DS Records?. For information about DNSSEC key rotation, see Rotate DNSSEC Keys. For a complete overview of DNSSEC at DNSimple, see DNS Security Extensions (DNSSEC) at DNSimple.
Have more questions?
If you want to explore more DNSSEC terms, take a look at our DNSSEC Glossary. Ready to get started with DNSSEC? Read Enable DNSSEC. If you have further questions or need any assistance, contact our support team, and we’ll be happy to help.