It should be noted that in DNS the root is a zone unto itself. Thus the root zone key should only be seen signing itself or signing RRs with names one level below root, such as .aq, .edu, or .arpa. Implementations MAY reject as bogus any purported root signature of records with a name more than one level below root. The root zone contains the root KEY RR signed by a SIG RR under the root key itself.