Editing DNS root zone (section)

===ZONEMD record===
While the root zone file is signed with DNSSEC, some DNS records, such as NS records, are not covered by DNSSEC signatures. To address this weakness, a new DNS Resource Record, called ZONEMD, was introduced in [https://www.rfc-editor.org/rfc/rfc8976 RFC 8976]. ZONEMD doesn't replace DNSSEC. ZONEMD and DNSSEC must be used together to ensure the full protection of the DNS root zone file.<ref>{{cite web |last1=Wessels |first1=Duane |title=Adding ZONEMD Protections to the Root Zone |url=https://blog.verisign.com/security/root-zone-zonemd/ |website=Verisign Blog |date=April 18, 2023}}</ref><ref>{{cite web |author1=D. Wessels |author2=P. Barber |author3=M. Weinberg |author4=W. Kumari |author5=W. Hardaker |title=RFC 8976 Message Digest for DNS Zones |url=https://www.rfc-editor.org/rfc/rfc8976 |access-date=10 March 2024 |date=February 2021}}</ref>

The ZONEMD deployment for the DNS root zone was completed on December 6, 2023.<ref>{{cite web |last1=Wessels |first1=Duane |title=[dns-operations] Root zone operational announcement: introducing ZONEMD for the root zone |url=https://lists.dns-oarc.net/pipermail/dns-operations/2023-December/022388.html |access-date=10 March 2024 |date=2023-12-06}}</ref>