hi, john, jelte and I just had an interesting discussion on jabber. a KSK is a key that signs all DNSKEY RRset. we all agree on that. but does a ZSK sign all RRSETs or all non-DNSKEY RRsets? if so, a key can be both a KSK and a ZSK. so, dear list, please advice! jakob