[Opendnssec-develop] KSK vs ZSK

Jakob Schlyter jakob at kirei.se
Thu Mar 5 13:22:17 UTC 2009


john, jelte and I just had an interesting discussion on jabber.

a KSK is a key that signs all DNSKEY RRset. we all agree on that.
but does a ZSK sign all RRSETs or all non-DNSKEY RRsets? if so, a key  
can be both a KSK and a ZSK.

so, dear list, please advice!


More information about the Opendnssec-develop mailing list