Which of the following information, within a DNSSEC- signed zone, is signed by the key signing key?

Question

Options

• AThe non-DNSSEC records like A, AAAA or MX.
• BThe zone signing key of the zone.
• CThe RRSIG records of the zone.
• DThe NSEC or NSEC3 records of the zone.
• EThe DS records pointing to the zone.

• A
  7% (3)
• B
  87% (39)
• C
  4% (2)
• E
  2% (1)

Explanation

In DNSSEC's two-key model, the Key Signing Key (KSK) signs only the DNSKEY RRset - the record set that publishes both the KSK and ZSK public keys - which means it is specifically signing the Zone Signing Key (ZSK) that lives in that RRset (B). The actual zone data records like A, AAAA, and MX (A) and denial-of-existence records like NSEC/NSEC3 (D) are signed by the ZSK, not the KSK. RRSIG records (C) are the output of the signing process, not something signed themselves - the KSK produces an RRSIG over the DNSKEY RRset, but that RRSIG isn't what's being "signed." DS records (E) live in the parent zone and are signed by the parent's ZSK, establishing the chain of trust downward to the child zone's KSK; the child's KSK plays no role in signing them.

Memory tip: Match the name to the job - the KSK signs the Keys (DNSKEY RRset), while the ZSK signs the Zone data. The KSK's only purpose is to vouch for the ZSK.

No community discussion yet for this question.