DNSSEC is the security extension of DNS and it is recommended to enable DNSSEC in all zones to mitigate DNS cache poisoning attacks. KSK (Key signing key) and ZSK (zone signing key) are used to generate RRSIGs of the zone records and the algorithms used to generate KSK/ZSK is very important in generating strong RRSIGs. Some of the zones has used SHA-1 as the security algorithm for KSK and ZSK. As the SHA-1 is an outdated algorithm, it is required to change the key algorithm in those zones. Anyone having any experiences in DNSSEC key algorithm roll over process, please let me know.

Thanks