A DNS server role that is responsible for all DNSSEC key management for a specific DNSSEC-signed DNS zone. Different DNS zones can have different Key Masters. The Key Master role can be moved from one DNS server to a different DNS server, but a DNS zone can have only one Key Master at a given time. To be a Key Master, the DNS server must be authoritative for the DNS zone, the zone must be signed with DNSSEC, and the DNS server must be selected to be the Key Master for the DNS zone.