---
title: DNSSEC keys · Cloudflare DNS docs
description: With Foundation DNS, you can request that the ZSK/KSK pair that is
  used for DNSSEC is unique to your Cloudflare account. To opt in to this
  feature, contact your account team.
lastUpdated: 2025-08-01T07:41:29.000Z
chatbotDeprioritize: false
source_url:
  html: https://developers.cloudflare.com/dns/foundation-dns/dnssec-keys/
  md: https://developers.cloudflare.com/dns/foundation-dns/dnssec-keys/index.md
---

With [Foundation DNS](https://developers.cloudflare.com/dns/foundation-dns/), you can request that the ZSK/KSK pair that is used for [DNSSEC](https://developers.cloudflare.com/dns/dnssec/) is unique to your Cloudflare account. To opt in to this feature, contact your account team.

All zones within your Cloudflare account - regardless of using [standard](https://developers.cloudflare.com/dns/nameservers/#standard-nameservers) or [advanced nameservers](https://developers.cloudflare.com/dns/foundation-dns/advanced-nameservers/) - will use the dedicated Zone Signing Key (ZSK) and Key Signing Key (KSK) for DNSSEC. These keys are set at the account level.

## Further reading

For more background information, refer to [How DNSSEC works](https://www.cloudflare.com/learning/dns/dnssec/how-dnssec-works/).

For details about DNSSEC settings at Cloudflare, refer to the [DNSSEC documentation](https://developers.cloudflare.com/dns/dnssec/).
