Key signing key (KSK)
An operational role for a DNSKEY that primarily signs the DNSKEY RRset. A parent DS normally points to a KSK, though DNSSEC protocol flags do not fully enforce operational roles.
Read definitionCategory glossary
Browse the glossaryDNSSEC glossary — page 2
49 definitions associated with DNSSEC.
Browse DNSSEC definitions
49 matching terms
Page 2 of 3Key tag
A 16-bit value calculated from a DNSKEY and included in RRSIG and DS records to help identify the relevant key. It is an index hint, not a globally unique identifier.
Read definitionKSK
The common abbreviation for Key Signing Key. It is usually the key whose digest is represented by the parent DS record.
Read definitionNSEC record
A DNSSEC record that links to the next existing name in canonical order and lists record types present at its owner. It proves name or type nonexistence but can permit zone walking.
Read definitionNSEC3 opt-out
A flag allowing NSEC3 chains in delegation-heavy zones to omit some unsigned delegations. It reduces signing cost but changes the security proof around insecure delegations.
Read definitionNSEC3 record
A hashed denial-of-existence record designed to make straightforward zone enumeration more difficult than NSEC. It adds iterations, salt, and opt-out behavior, with operational and computational tradeoffs.
Read definitionNSEC3PARAM record
A zone-apex record publishing the NSEC3 parameters used to generate hashed owner names, such as algorithm, iterations, and salt. Validators primarily rely on parameters in NSEC3 records themselves.
Read definitionNXNAME record
A DNS record type assigned for compact denial of existence. It is intended to support efficient authenticated nonexistence mechanisms defined by its associated specification.
Read definitionOffline signing
A model in which zone data is signed outside the serving authoritative server, then transferred or published as a signed zone. It can isolate private keys but adds publication and freshness complexity.
Read definitionOpt-out
A feature, most notably NSEC3 opt-out, that lets a signed delegation-centric zone omit some insecure delegations from the authenticated chain. It improves scalability but weakens proof granularity around those delegations.
Read definitionP-code
A generic informal reference to a protocol or algorithm code point. Documentation should use the exact registry field, such as DNSSEC algorithm number, digest type, or option code, to avoid ambiguity.
Read definitionRRSIG record
A DNSSEC signature record covering an RRset. It identifies the covered type, algorithm, signer, key tag, inception and expiration times, and cryptographic signature.
Read definitionSecure
A validation state indicating that DNS data has a valid chain of trust to a configured trust anchor and its signatures verify successfully.
Read definitionSecure delegation
A delegation in which the parent publishes a valid DS record for the child, allowing validators to continue the chain of trust into the child zone.
Read definitionSelf-signed trust anchor
A DNSKEY used directly as a configured trust anchor, normally validated through its self-signature and an out-of-band trust process rather than a parent DS record.
Read definitionSignature expiration
The time after which an RRSIG is no longer valid. Signing automation must refresh signatures early enough to survive outages, propagation, and clock differences.
Read definitionSignature inception
The time before which an RRSIG is not yet valid. Signers often backdate inception slightly to tolerate clock skew.
Read definitionSigner
The system or process that creates RRSIG records using DNSSEC private keys. It may run inline on an authoritative server, on a hidden primary, in an HSM-backed service, or offline.
Read definitionTLSA record
A record that associates a TLS service with an expected certificate or public key using usage, selector, and matching fields. Secure use depends on DNSSEC validation.
Read definitionTrust anchor
A configured DNSKEY or DS record that a validator accepts as the starting point for a chain of trust. The root DNSKEY is the most common public-DNS trust anchor.
Read definitionType bitmap
A compact bitmap listing the resource-record types present at an owner name, used in NSEC and NSEC3 records to prove the absence of a requested type.
Read definitionUnsigned delegation
A delegation to a child zone without a parent DS record. From a signed parent it creates an intentional insecure boundary rather than a secure chain.
Read definitionValidating resolver
A recursive resolver that performs DNSSEC validation and classifies responses as secure, insecure, bogus, or indeterminate. It may set AD for trusted clients when validation succeeds.
Read definitionZone signing key (ZSK)
An operational DNSSEC key role primarily used to sign ordinary zone RRsets. ZSKs are often shorter-lived and rolled more frequently than KSKs.
Read definition