@startuml !include theme.iuml rectangle "Nameserver" { rectangle KSKPub #LightBlue rectangle KSKPriv #Pink rectangle "Resource Records" as NSResourceRecords { rectangle DNSKEY #LightBlue } rectangle "RRSet" as NSRRSet #LightBlue rectangle "RRSig" as NSRRSig #LightGreen rectangle "label.example.com" { rectangle "Resource Records" as ResourceRecords { rectangle "AAAA" as AAAA1 rectangle "AAAA" as AAAA2 } rectangle RRSet rectangle ZSKPub #LightBlue rectangle ZSKPriv #Pink rectangle RRSig #LightGreen } } rectangle "Parent Nameserver" { rectangle KSKPubHash #LightGreen rectangle DS #LightGreen rectangle "KSKPub" as ParentKSKPub #LightBlue rectangle "KSKPriv" as ParentKSKPriv #Pink } rectangle "Parent Nameserver" as P2 { rectangle "KSKPubHash" as P2KSKPubHash #LightGreen rectangle "DS" as P2DS #LightGreen rectangle "KSKPub" as Parent2KSKPub #LightBlue rectangle "KSKPriv" as Parent2KSKPriv #Pink } AAAA1 -d-> RRSet AAAA2 -d-> RRSet ZSKPub -d-> DNSKEY RRSet -d-> RRSig ZSKPriv -l-> RRSig ZSKPriv -r- ZSKPub KSKPriv -r- KSKPub DNSKEY -d-> NSRRSet NSRRSet -d-> NSRRSig KSKPriv -l-> NSRRSig KSKPub -r-> KSKPubHash KSKPubHash -r-> DS KSKPubHash -[hidden]- ParentKSKPriv ParentKSKPriv -r-> ParentKSKPub ParentKSKPub -r-> P2KSKPubHash P2KSKPubHash -r-> P2DS P2KSKPubHash -[hidden]- Parent2KSKPriv Parent2KSKPriv -r-> Parent2KSKPub legend * DS - Delegation Signer * KSK - Key Signing Key * ZSK - Zone Signing Key * RRSet - Resource Record Set * DNSKEY - Published Pubkey * NSEC(3) - No record (Explicit Authenticated Denial) end legend @enduml