DNS Extension (EDNS0) A DNS record that carries extended DNS header RFC 2671 [3] information, such as the DO bit and maximum UDP packet size DNS Security Extensions Extensions to the DNS service that provide RFCs 4033 [5], (DNSSEC) mechanisms for signing and securely resolving 4034 [6], and DNS data 4035 [7] DNSKEY record A DNSSEC record type used to store a public RFC 4034 [6] key. Section 2 DNSSEC OK (DO) bit A bit in the EDNS0 portion of a DNS request RFC 4035 [7] that signals that the client is DNSSEC-aware. Section 3.2.1 Double Signature Double signature is a key rollover method RFC 4641 where a future key and signatures generated using it are published into the DNS zone before the existing key and its signatures are deleted, thus leaving two sets of keys and associated signatures in the zone at any given time. Island of Security A signed zone that does not have an RFC 4033 [5] authentication from its delegating parent Section 2 zone Key Master (KM) The key master is the DNS server that is responsible for key generation and management, and acts as the server that the administrator interacts with to set up DNSSEC. Key Rollover A key rollover (also called key supercession in RFC 4641 some environments) is the act of replacing one key pair with another at the end of a key effectivity period. Key Signing Key (KSK) The KSK is an authentication key that RFC 4033 corresponds to a private key used to sign one section 2 or more other signing keys for a given zone. Typically, the private key corresponding to a KSK will sign a ZSK, which in turn has a corresponding private key that will sign other zone data. Local policy may require that the ZSK be changed frequently, while the KSK may have a longer validity period in order to provide a more stable secure entry point into the zone. Designating an authentication key as a KSK is purely an operational issue: DNSSEC validation does not distinguish between KSKs and other DNSSEC authentication keys, and it is possible to use a single key as both a KSK and a ZSK.
DNS Extension (EDNS0) A DNS record that carries extended DNS header information, such as the DO bit and maximum UDP packet size RFC 2671 [3] DNS Security Extensions (DNSSEC) Extensions to the DNS service that provide mechanisms for signing and securely resolving DNS data RFCs 4033 [5], 4034 [6], and 4035 [7] DNSKEY record A DNSSEC record type used to store a public key. RFC 4034 [6] Section 2 DNSSEC OK (DO) bit A bit in the EDNS0 portion of a DNS request that signals that the client is DNSSEC-aware. RFC 4035 [7] Section 3.2.1 Double Signature Double signature is a key rollover method where a future key and signatures generated using it are published into the DNS zone before the existing key and its signatures are deleted, thus leaving two sets of keys and associated signatures in the zone at any given time. RFC 4641 Island of Security A signed zone that does not have an authentication from its delegating parent zone RFC 4033 [5] Section 2 Key Master (KM) The key master is the DNS server that is responsible for key generation and management, and acts as the server that the administrator interacts with to set up DNSSEC. Key Rollover A key rollover (also called key supercession in some environments) is the act of replacing one key pair with another at the end of a key effectivity period. RFC 4641 Key Signing Key (KSK) The KSK is an authentication key that corresponds to a private key used to sign one or more other signing keys for a given zone. Typically, the private key corresponding to a KSK will sign a ZSK, which in turn has a corresponding private key that will sign other zone data. Local policy may require that the ZSK be changed frequently, while the KSK may have a longer validity period in order to provide a more stable secure entry point into the zone. Designating an authentication key as a KSK is purely an operational issue: DNSSEC validation does not distinguish between KSKs and other DNSSEC authentication keys, and it is possible to use a single key as both a KSK and a ZSK. RFC 4033 section 2
understand_and_troubleshoot_dnssec_in_windows_server_8_beta.docx