Which information in a DNSSEC-signed zone is signed by the key signing key?

Which information in a DNSSEC-signed zone is signed by the key signing key?

• A. The non-DNSSEC records like A, AAAA, or MX.
• B. The zone signing key of the zone.
• C. The RRSIG records of the zone.
• D. The DS records pointing to the zone.

Answer: (B)

In a DNSSEC-signed zone, the key signing key (KSK) is specifically used to sign the zone signing key (ZSK). This relationship is fundamental to the DNSSEC hierarchy and is designed to establish a secure chain of trust for the DNS records. When the KSK signs the ZSK, it creates a secure association between the two keys. This process allows resolvers to trust that the ZSK is indeed legitimate and has not been tampered with. This signing process is crucial because the ZSK is then used to sign the rest of the DNS records within the zone, including A, AAAA, MX, and other resource records. In contrast, the other options involve different aspects of DNSSEC. Non-DNSSEC records are not signed by the KSK; they are part of the data held in the zone but do not carry the cryptographic protection that DNSSEC provides. RRSIG records, which contain the signatures for the actual DNS records (A, AAAA, etc.), are created by signing those records with the ZSK, not the KSK. DS records, which are used to enable delegation to child zones, are also not signed by the KSK; rather, they are placed in the parent zone

In a DNSSEC-signed zone, the key signing key (KSK) is specifically used to sign the zone signing key (ZSK). This relationship is fundamental to the DNSSEC hierarchy and is designed to establish a secure chain of trust for the DNS records.

When the KSK signs the ZSK, it creates a secure association between the two keys. This process allows resolvers to trust that the ZSK is indeed legitimate and has not been tampered with. This signing process is crucial because the ZSK is then used to sign the rest of the DNS records within the zone, including A, AAAA, MX, and other resource records.

In contrast, the other options involve different aspects of DNSSEC. Non-DNSSEC records are not signed by the KSK; they are part of the data held in the zone but do not carry the cryptographic protection that DNSSEC provides. RRSIG records, which contain the signatures for the actual DNS records (A, AAAA, etc.), are created by signing those records with the ZSK, not the KSK. DS records, which are used to enable delegation to child zones, are also not signed by the KSK; rather, they are placed in the parent zone