What is the difference between a KSK and a ZSK?

The key-signing key (flag 257) signs the DNSKEY set and is referenced by the parent’s DS record; zone-signing keys (flag 256) sign everything else.

Which algorithms are recommended?

Modern zones use ECDSA P-256 (13) or Ed25519 (15). RSA/SHA-1 algorithms (5, 7) are deprecated.

DNSKEY Lookup

A DNSKEY record holds one of the public keys a DNSSEC-signed zone uses to sign its records. This lookup lists the zone’s keys with their key tags, algorithms, and roles as key-signing or zone-signing keys.

When to use this: You are enabling DNSSEC, rolling a key, or comparing the zone’s keys with the DS record at the registrar. Command prefix dnskey:

About the DNSKEY Lookup

Show a zone’s DNSSEC public keys with key tags, algorithms and roles (key-signing vs zone-signing).

FAQ

What is the difference between a KSK and a ZSK?: The key-signing key (flag 257) signs the DNSKEY set and is referenced by the parent’s DS record; zone-signing keys (flag 256) sign everything else.
Which algorithms are recommended?: Modern zones use ECDSA P-256 (13) or Ed25519 (15). RSA/SHA-1 algorithms (5, 7) are deprecated.