DNSSEC Practice Statement for the Root Zone KSK Operator

This document is the DNSSEC Practice Statement (DPS) for the Root Zone Key Signing Key (KSK) Operator. It states the practices and provisions that are used to provide Root Zone Key Signing and Key Distribution services. These include, but are not limited to: issuing, managing, changing and distributing DNS keys.¶
Copyright 2009-2026 Internet Corporation for Assigned Names and Numbers. Copyright 2009 VeriSign, Inc. This work is based on the Certification Practice Statement, Copyright 1996-2004 by Verisign, Inc. Used by Permission. All Rights Reserved.¶
ICANN is a registered trademark of the Internet Corporation for Assigned Names and Numbers.¶
VERISIGN is a registered trademark of Verisign, Inc.¶
1.2. Document Name and Identification
1.3. Community and Applicability
1.3.1. Root Zone Manager
1.3.2. Root Zone Maintainer
1.3.3. Root Server Operators
1.3.4. Root Zone Key Signing Key Operator
1.3.5. Root Zone Zone Signing Key Operator
1.3.6. Child Zone Manager
1.3.7. Relying Party
1.3.8. Applicability
1.4. Specification Administration
1.4.1. Specification Administration Organization
1.4.2. Contact Information
1.4.3. Specification Change Procedures
2. Publication and Repositories
2.2. Publication of Key Signing Keys
2.3. Access Controls on Repositories
3. Operational Requirements
3.1. Meaning of Domain Names
3.2. Activation of DNSSEC for Child Zone
3.3. Identification and Authentication of Child Zone Manager
3.4. Registration of Delegation Signer Resource Records
3.5. Method to Prove Possession of Private Key
3.6. Removal of DS Resource Records
3.6.1. Who can Request Removal
3.6.2. Procedure for Removal Request
3.6.3. Emergency Removal Request
4. Facility, Management, and Operational Controls
4.1. Physical Controls
4.1.1. Site Location and Construction
4.1.2. Physical Access
4.1.3. Power and Air Conditioning
4.1.4. Water Exposures
4.1.5. Fire Prevention and Protection
4.1.6. Media Storage
4.1.7. Waste Disposal