A zone must be signed before any other DNSSEC-Tools-related actions may be taken with it. This section describes how to sign a zone for the first time.

If a zone has been signed, it must be resigned when any change is made to it. Follow Chapter 6, Resigning a Zone when resigning a zone.