2.3.6 Signers Other Than The Zone

There are two cases where a SIG resource record is signed by other than the zone private key. One is for support of dynamic update where an entity is permitted to authenticate/update its own records. The public key of the entity must be present in the DNS and be appropriately signed but the other RR(s) may be signed with the entity's key. The other is for support of transaction and request authentication as described in Section 2.4 immediately below.