Signing a DNS zone is not as simple as having one private key. Because DNS zones can contain thousands of records and are accessed billions of times, using a single key for everything would be a security and operational nightmare. DNSSEC uses a two-tiered key system: the Zone Signing Key (ZSK) and the Key Signing Key (KSK).
The ZSK is used to sign the actual data records (A, MX, TXT) in the zone. These signatures (RRSIGs) expire frequently (e.g., every 30 days). Because the ZSK is used so often, it is more exposed to potential cryptanalysis. Therefore, the ZSK is designed to be rotated frequently.
💡 The ZSK's public key is stored in the DNSKEY record, but it is NOT hashed into the parent's DS record. This means you can change the ZSK without ever notifying the TLD registrar.
# Generating a ZSK with BIND (Conceptual)
dnssec-keygen -a RSASHA256 -n ZONE zone.comBy separating the data-signing key from the identity-verifying key, administrators can rotate the ZSK without breaking the global chain of trust.
The KSK has one job: it signs the ZSK. It does not sign the A or MX records. The KSK is the 'Master Key' of the zone. Its public key is hashed and sent to the parent zone as the DS record. Because the KSK is rotated very rarely (years), it can be much stronger (e.g., RSA-4096 or ECDSA P-256).
⚠️ Losing the KSK private key is a catastrophic event. Since the KSK is the only key that can sign the ZSK, and it is the only key that matches the DS record in the TLD, losing it means you cannot update your zone's security without manual intervention from your registrar.
| Feature | Zone Signing Key (ZSK) | Key Signing Key (KSK) |
|---|---|---|
| Purpose | Signs Resource Records (A, MX, etc.) | Signs the ZSK |
| Rotation Frequency | Frequent (Weeks/Months) | Rare (Years) |
| Key Length | Shorter (e.g. 1024-2048) | Longer (e.g. 2048-4096) |
| Parent Link | None | DS Record in TLD |
The actual signing process works like this: 1. The administrator creates a ZSK and a KSK. 2. The ZSK signs the A records (producing RRSIGs). 3. The KSK signs the ZSK (producing an RRSIG for the DNSKEY record). 4. The hash of the KSK is uploaded to the registrar as the DS record.
Avoid using the same key for both ZSK and KSK (Single-Key Setup). While simpler, it means every time you rotate your key, you must update the DS record at the registrar, increasing the risk of a misconfiguration that takes your site offline.
Verify exercises to earn ★ 160 XP and unlock next lab level.