Resource Records for the DNS Security Extensions

RFC 4034 defines the new DNS resource record types introduced by DNSSEC: DNSKEY, RRSIG, NSEC, and DS. It specifies their wire format, signing procedures, and how they interlock to form a chain of trust from the DNS root down to individual zone delegations.