Each zone publishes DNSKEY records (flag 257 for the key-signing key, 256 for the zone-signing key) and signs every record set with RRSIG records that carry inception and expiration times. The parent zone publishes a DS record, a digest of the child's key-signing key (digest type 2 = SHA-256, 4 = SHA-384), creating a chain up to the root's trust anchor. Authenticated denial uses NSEC or NSEC3, whose iteration count RFC 9276 says should be 0.
Common algorithms: 8 (RSA/SHA-256), 13 (ECDSA P-256/SHA-256, the usual choice today) and 15 (Ed25519). Since RFC 9904 (2025), the recommended status of each algorithm lives in the IANA registry rather than in an RFC.
DNSSEC protects integrity, not confidentiality (DoH and DoT do that), and only for resolvers that validate. Outages come from expired signatures, a DS that no longer matches after a key rollover and clock skew; when validation fails, resolvers return SERVFAIL. DANE, CAA checks by CAs and SSHFP rely on it.