DNS & Glossary

DNSKEY record

Holds the public keys that resolvers use to verify a zone's DNSSEC signatures — split into a Key-Signing Key and a Zone-Signing Key.

What it stores

A DNSKEY record contains a zone's public signing key. Zones typically use two: a Key-Signing Key (KSK), which the parent's DS record vouches for, and a Zone-Signing Key (ZSK), which signs the individual records. Resolvers walk KSK → ZSK → records to validate answers.

Why it matters

  • It anchors signature verification for the whole zone under DNSSEC.
  • Separating KSK and ZSK allows routine ZSK rotation without touching the parent DS.

Common mistakes

  • Letting signatures expire because the signing process stopped, causing validation failures.
  • Botching a key rollover so the published DNSKEY no longer matches the parent DS.

How WebInspect checks this

  • The Network Inspector reports DNSSEC key presence and validation status.