Concepts

Explanatory deep-dives into how go53 works under the hood:

• DNSSEC — the signing model, refresh and jitter timing, query-time signing, NSEC/NSEC3 denial, parent signaling (DS/CDS/CDNSKEY), and the key lifecycle.
• Distributed Mode — multi-node replication: architecture, Ed25519 signing, the frame protocol, vector clocks, and Merkle-tree integrity repair.
• Query Path & Record Storage — how a query is answered, the owner index behind negative answers and wildcards, the record decode layer, how zone data is stored and canonicalised, and what upgrades migrate.