Overview
A Key Signing Key (KSK) is a cryptographic key used by DNS Security Extensions (DNSSEC) to authenticate the public keys published for a DNS zone.
DNSSEC allows validating DNS resolvers to check the origin and integrity of signed DNS data. DNSSEC does not encrypt DNS queries or responses.
How the KSK and ZSK Work Together
In a DNSSEC configuration with separate key roles, the KSK signs the zone's DNSKEY record set. This record set contains the public KSK and the public Zone Signing Key (ZSK).
The ZSK signs other record sets in the zone. A record set is a group of DNS records that have the same name and record type, such as the A records for www.example.com.
DNSSEC stores digital signatures in RRSIG records. A validating resolver uses the corresponding public key to check each signature.
Public and Private Keys
The KSK has a public key and a corresponding private key. The public key is published in a DNSKEY record. The private key creates digital signatures and must remain protected. The private key is not published in DNS.
The cryptographic algorithm determines how the key and signatures are created. Key size requirements depend on the selected algorithm.
How the Parent Zone Establishes Trust
A Delegation Signer (DS) record in the parent zone identifies a public key in the child zone. The DS record includes a key tag, algorithm number, digest type, and digest. The digest is a cryptographic fingerprint calculated from the DNSKEY record and its owner name.
This connection allows a validating resolver to extend trust from the parent zone to the child zone's keys. For example, the DS record for example.com is published in the com parent zone.
A trust anchor is a trusted key or DS record configured as a starting point for validation. A zone's KSK is not automatically a trust anchor for every resolver.
What Happens During a KSK Rollover
A KSK rollover replaces an existing KSK with a new KSK. The transition must preserve DNSSEC validation while published records and cached information are updated.
A rollover requires coordination between the zone's DNSKEY records and the parent zone's DS records. An incorrect transition can break the chain of trust and cause DNS resolution failures for users of validating resolvers.
What UltraDNS Customers Should Know
When you sign a zone in UltraDNS, UltraDNS creates the DNSKEY, RRSIG, and DS records associated with signing. Creating the DS information in UltraDNS does not publish that information in the parent zone.
During a KSK rollover, you must submit the new DS information through the domain registrar so that the parent zone can be updated. Follow the documented rollover procedure before changing or removing existing DS records.