A zone usually has two roles for keys:
- The KSK (key-signing key) signs only the DNSKEY set. The parent's DS points at it. Changing it means a change at the registrar.
- The ZSK (zone-signing key) signs everything else. It can change often without touching the registrar.
A CSK (combined signing key) does both jobs. With short, strong ECDSA keys, many operators use one CSK and roll it rarely. This site uses one ECDSA P-256 CSK.
Rolling a ZSK: pre-publish
- Publish the new ZSK in the DNSKEY set, still signing with the old one.
- Wait for the DNSKEY TTL, so caches have the new key.
- Sign with the new key.
- Wait until the old signatures have expired from caches, then remove the old key.
Rolling a KSK: double-DS or double-KSK
- Add the new KSK and sign the DNSKEY set with both keys (double-KSK), or publish the new DS next to the old one (double-DS).
- Change the DS at the registrar to the new key.
- Wait for the parent's DS TTL, then remove the old KSK.
The rule in both: never let a cache hold a DS or signature that points at a key it cannot get. RFC 6781 and RFC 7583 describe the timing in detail. Signers like PowerDNS, BIND's dnssec-policy and Knot can run rollovers for you.
The root KSK
The whole chain starts at the root zone's KSK, the trust anchor built into validating resolvers. It was rolled once, in October 2018 (KSK-2010 to KSK-2017), the first rollover of the root key since DNSSEC was deployed at the root in 2010.