What is the purpose of a DNSKEY record in DNSSEC?

Question

Options

• ATo verify the authenticity of a DNS query
• BTo sign a DNS zone
• CTo provide information about a DNS server
• DTo map an IP address to a hostname

• A
  2% (1)
• B
  92% (45)
• C
  2% (1)
• D
  4% (2)

Explanation

A DNSKEY record stores the public cryptographic key used to sign a DNS zone, enabling DNSSEC validation - making B correct. When a DNS resolver receives a response, it uses the public key in the DNSKEY record to verify the digital signatures (stored in RRSIG records) attached to other DNS records in that zone.

Why the distractors are wrong:

• A is close but misleading - DNSKEY doesn't verify queries; it enables verification of responses/records. That distinction belongs to the validation process using RRSIG records together with DNSKEY.
• C describes an NS (Name Server) or SOA record, which carry information about the authoritative DNS server for a zone.
• D describes a PTR record, which performs reverse DNS lookups (IP → hostname).

Memory tip: Think "DNSKEY = the key to the zone's signature." The word KEY tells you it stores a cryptographic key, and since DNSSEC is about signing zones to prove authenticity, the DNSKEY is what makes zone signing verifiable. Pair it mentally with RRSIG (the actual signature) - DNSKEY is the lock, RRSIG is what was locked.

No community discussion yet for this question.