Editing DNS root zone (section)

===Signing of the root zone===
Since July 2010, the root zone has been signed with a [[DNSSEC]] signature,<ref>{{cite web|url=http://www.root-dnssec.org/|title=Root DNSSEC: Information about DNSSEC for the Root Zone|publisher=Internet Corporation For Assigned Names and Numbers|access-date=March 19, 2014}}</ref> providing a single [[trust anchor]] for the Domain Name System that can in turn be used to provide a trust anchor for other [[public key infrastructure]] (PKI). The root zone DNSKEY section is re-signed periodically with the root zone [[Domain_Name_System_Security_Extensions#Key_management|key signing key]] performed in a verifiable manner in front of witnesses in a [[Key ceremony|key signing ceremony]].<ref>{{cite web|url=https://www.icann.org/news/announcement-2-2010-06-07-en |title=First KSK Ceremony |publisher=Internet Corporation For Assigned Names and Numbers |date=April 18, 2010 |access-date=October 19, 2014 |url-status=dead |archive-url=https://web.archive.org/web/20150414231507/https://www.icann.org/news/announcement-2-2010-06-07-en |archive-date=April 14, 2015 }}</ref><ref>{{cite web|url=https://www.iana.org/dnssec/ceremonies|title=Root KSK Ceremonies|publisher=Internet Assigned Numbers Authority|date=November 12, 2015|access-date=November 17, 2015}}</ref>
The KSK2017 with ID 20326 is valid as of 2020.