Don't have an account? Sign up
If you're already signed up, please sign in
Key Rollover — the coordinated replacement of a DNSSEC signing key while old and new DNSKEY, signature, and sometimes DS data overlap long enough to preserve validation.
DNSSEC authenticates DNS data and protects its integrity with digital signatures; it does not encrypt queries. The chain of trust runs from the root through a DS record to the child zone’s keys, and an inconsistent link causes validation failure.
Key Rollover — the coordinated replacement of a DNSSEC signing key while old and new DNSKEY, signature, and sometimes DS data overlap long enough to preserve validation.
It creates, publishes, or validates part of the chain of trust so a validating resolver can determine whether data was signed by an authorized key and remained unchanged.
Verify algorithms, signature validity periods, DS-to-DNSKEY matching, required records on every authoritative server, and successful external validation before removing old keys.
