---
id: "ksk"
kind: "glossary-term"
title: "KSK"
language: "en"
category: "DNS and technical foundations"
updated: "2026-10-04T14:01:23Z"
canonical: "https://tldlog.com/glossary/ksk/"
translations:
  es: "https://tldlog.com/es/glosario/ksk/"
  de: "https://tldlog.com/de/glossar/ksk/"
  fr: "https://tldlog.com/fr/glossaire/ksk/"
  it: "https://tldlog.com/it/glossario/ksk/"
  pt-BR: "https://tldlog.com/pt/glossario/ksk/"
  ru: "https://tldlog.com/ru/glossariy/ksk/"
  zh-Hans: "https://tldlog.com/zh/cihui/ksk/"
---

# KSK

Key Signing Key

In DNSSEC, the key a zone uses only to sign its own set of keys. A fingerprint of it is placed in the parent zone as the DS record, so changing it involves the registry. The root zone's KSK is the starting point of trust for the whole system.

## related terms

- [ZSK](https://tldlog.com/glossary/zsk/)
- [DNSKEY record](https://tldlog.com/glossary/dnskey-record/)
- [DS record](https://tldlog.com/glossary/ds-record/)
- [key rollover](https://tldlog.com/glossary/key-rollover/)
- [trust anchor](https://tldlog.com/glossary/trust-anchor/)