# Include name and links to their social media
translation:
  source: ""

# Navigation
nav:
  episodes: "Episodes"
  about: "About"
  ep1: "Why do we need DNSSEC?"
  ep2: "New records"
  ep3: "Key-Signing Who?"
  ep4: "Trust the hierarchy"
  ep5: "Human DNS"
  social: "Be a social taco"
  more_comics: "Read more comics"
  continue_reading: "Continue reading"
  play_game: "Play the DNSSEC game"

not_found:
  title: "Page not found"
  description: "Sorry, page not found"

episodes:
  title: "DNSSEC Comic: Explore all the episodes: Discover Why DNS needs security"
  description: "Explore each chapter of the DNSSEC comic made by DNSimple. What is DNSSEC? And how does DNSSEC work? Dive into secure domain insights with humor and clarity."

# Home page
home:
  title: "How DNSSEC works"
  sub_title: "What is DNSSEC? Dive into DNSimple's fun, illustrated comic to learn all about it!"
  seo_title: "DNSSEC Explained: A Fun, Illustrated Comic by DNSimple"
  description: "Dive into DNSSEC basics with DNSimple's engaging comic! Learn how DNS works, discover why security matters, and enjoy a lighthearted take on a technical topic."
  big_cta: "Start reading"
  p1: "How do you feel about a taco explaining you how DNSSEC works? Sometimes, when you're stuck understanding a topic, mixing it up with something completely different may help grasping it."
  p2: "We created this comic as a fun side project. We work with DNS, SSL certificates, and DNSSEC all day long, so we want to share what we know. We hope you enjoy it!"
  small_cta: "Let's do this"

about:
  title: "About Our DNSSEC Comic: A quirky peek behind the scenes at DNSimple"
  description: "Discover how DNSSEC, tacos, and a dash of teenage-level moodiness come together in our comic. Meet the DNSimple team, learn why DNSSEC matters, and enjoy an entertaining spin on secure domains."
  1: "Welcome to our DNSSEC comic's 'About' page. You might notice there's no fancy background gradient here, but that's all part of the charm. We like to keep things real (and occasionally sprinkle in some teenage-level moodiness for fun).</p>"
  2: "Why this comic?"
  3: "Because DNSSEC is a big deal. It's complicated, but it doesn't have to be boring. We want to demystify it in the most entertaining way possible, complete with quirky jokes (we're not biased or anything), tacos, and a healthy disregard for plain-vanilla presentations."
  4: "Who's behind it?"
  5: "This project comes from the fine folks at DNSimple. We sell domains and keep them running smoothly. Think of us as DNS by people who get it. We've been a 100% remote team since 2010, scattered across Europe, Asia, and the Americas, yet perfectly synced in our love of tacos…and DNSSEC."
  6: "What else do we do?"
  7: "We offer SSL certificates and an API that's rock-solid (not our words, we swear!). That way you can automate and manage your domains, taco in one hand, keyboard in the other. Why waste precious taco time fiddling with DNSSEC?"
  8: "Anyway…"
  9: "Thanks for stopping by! Enjoy the comic, learn a bit, laugh a lot, and definitely grab some tortillas on your way out. Got the salsa handy?"

translate:
  title: "Translate How DNSSEC works Comic | YAML Guide & Submission"
  description: "Download the English YAML template, translate the comic's text, and learn how to submit your version for publication on howdnssec.works, with full attribution."

# Episodes
ep1:
  title: "DNSSEC 101: why do we need DNSSEC?"
  description: "Discover how DNSSEC helps prevent tampering by verifying DNS responses. Learn why it's crucial for secure web navigation, plus get a refresher on resolvers and authoritative servers."
  1: "Good question! Why do we need DNSSEC?"
  2: "DNS was created the Internet was tiny small."
  3: "Security was not a primary concern in its design."
  4: "Simply put, DNS main job is to translate human-friendly names to IP addresses needed by your laptop, phones, and other network devices."
  5: "DNS is like a big phone book that your devices use to fetch you a website, or deliver your emails."
  6: "**DNS resolvers** are the ones in charge of tracking down this information for you."
  7: "And that data is often provided by **authoritative servers**."
  8: "But DNS resolvers have no way to verify the authenticity of a response from an authoritative server."
  9: "What if the response has been tampered with?"
  10: "This is where **DNSSEC** comes in."
  11: "Resolvers? Authoritative name servers? What are all these things? Check out <a href='https://howdns.works' target='_blank'>**HowDNS.works**</a> for a refresher and come back here."
  12: "I'll be waiting."
  13: "DNSSEC is short for Domain Name System Security Extensions."
  14: "Like HTTPS, DNSSEC provides a layer of security by allowing authenticated answers on top of DNS."
  15: "However, there is a important difference."
  16: "HTTPS encrypts traffic so no crabs can spy on your data."
  17: "**DNSSEC signs DNS data** to detect that no crabs have been messing with your DNS responses."
  18: "Bad crab. Bad."
  19: "DNSSEC doesn't include full encryption like HTTPS does."
  20: "The data is not kept confidential and secret between the resolver and the authoritative server."
  21: "Let's dig a bit deeper into DNSSEC. Ready?"

ep2:
  title: "DNSSEC Essentials: How RRSets, RRSIG, and DNSKEY Work Together"
  description: "Explore how DNSSEC secures DNS data using RRSets, zone-signing keys, and resource record signatures. Learn about private/public key pairs, hashing, and how resolvers verify authenticity."
  1: "To validate the authenticity of the DNS data, DNSSEC introduces a small number of new DNS record types."
  2: "The first thing that your DNS provider is going to do when you configure your domain with DNSSEC is to bundle all records into **RRsets**."
  3: "The RR in RRsets stands for resource records. A fancy way to say 'records of the same type and name' for a zone or domain."
  4: "RRsets bundle all records of the same type and name into a group that is digitally signed."
  5: "In the physical world, humans use signatures to bind the identity and authenticity of a message."
  6: "The same analogy can be carried out in the DNSSEC world."
  7: "The authoritative server signs each RRset with a **zone-signing key pair**."
  8: "We'll be talking about more keys later, so remember these keys are used to produce and verify a signature on the zone records."
  9: "Every zone-signing key has a **private** and **public** key pair. This is the basis of asymmetric cryptography."
  10: "Private and public keys work together. Data encrypted with the private key can be decrypted or validated with the public key."
  11: "The public key can be shared with anyone. It's public, and available to everyone."
  12-1: "Private keys are &mdash; you guessed it, private and shouldn't be shared."
  12-2: "Don't let the crabs get these!"
  13: "Together these two keys provide two important features!"
  14-1: "**One**: Verify that the content comes from the right source."
  14-2: "**Two**: Verify that the content hasn't been altered since it was sent."
  15: "These keys aren't used to encrypt the entire content of the records. Instead, a digital signature is produced by taking a portion of the RRSet, hashing it and encrypting it."
  16-1: "The hashing process is not just relevant for validation purposes."
  16-2: "Hashing reduces the size of the content to be sent, making the signature a fixed length."
  17: "This is important because we want to keep the DNS protocol small and lightweight."
  18: "The signatures are stored in a DNS record called an **RRSIG** (Resource Record Signature)."
  19: "And the public key to decrypt that RRSIG record is stored in a new DNS record type called **DNSKEY**."
  20: "Here's how it happens..."
  21: "Some content from the RRset is hashed through a hashing algorithm."
  22: "The result is encrypted with the private section of the zone-signing key creating a RRSIG record."
  23: "Then the authoritative server sends the RRset and the RRSIG to the resolver."
  24: "The resolver takes the RRSet and hashes again, just like the authoritative server did with the same algorithm."
  25: "The resolver decrypts the signature record with the public portion of the zone-signing key into a hash."
  26: "If both hashes match, then the resolver knows that the response is coming from the expected source that hasn't been tampered with."
  27: "A resolver that doesn't support DNSSEC, or is missing the algorithm to support the hashing steps would ignore the signature coming back with the record."
  28: "Here's the current flow when the DNS resolver requests the A record for www.dnsimple.com."
  29: "The authoritative server returns the A record in both an RRset and the RRSIG record."
  30: "The resolver then asks for the DNSKEY record to validate that the requested record is valid and coming from a trusted source."
  31: "The resolver validates the response through the RRset, the RRSIG, and the DNSKEY."
  32: "But what if the DNSKEY was compromised?"

ep3:
  title: "DNSSEC Key-Signing Keys: Extending the Chain of Trust"
  description: "Learn how key-signing keys validate DNSKEY records and strengthen DNSSEC's chain of trust. Explore hierarchical zone relationships, RRSIGs, and how resolvers confirm authenticity in parent-child domains."
  1: "**Key-signing keys** are here to ensure that the DNSKEY can be trusted."
  2: "Key-signing keys validates the DNSKEY record in the same way the zone-signing keys secured the RRsets."
  3: "Here's what we have so far:"
  4: "Records are bundled in RRsets and signed by zone-signing keys. The public portion of that key is stored in a DNSKEY record."
  5: "That DNSKEY record is now signed with a key-signing key creating an additional RRSIG record."
  6: "The public portion of the key-signing key is stored in another DNSKEY record."
  7: "The 2 DNSKEY records are bundled in an RRset that is signed by the private key of the key-signing key."
  8: "Now, when the DNS resolver asks for the DNSKEY, they're going to get an RRset of DNSKEY records along with an RRSIG."
  9: "The process is now as follows..."
  10-1: "The resolver asks the authoritative name server for the A records for www.dnsimple.com."
  10-2: "www.dnsimple.com A record please?"
  11: "The authoritative server returns the RRset containing the A records along with an RRSIG that contains the signature of the zone-signing key."
  12-1: "The resolver queries the authoritative server again for the DNSKEY to validate the signature in the RRSIG record."
  12-2: "DNSKEY, please?"
  13: "The authoritative server returns an RRset containing the DNSKEY for the zone-signing and key-signing keys along with an RRSIG record."
  14: "The resolver now has all the information to validate the DNS query."
  15: "It verifies the RRSIG for the A records in the RRset with the DNSKEY created by the zone-signing key."
  16: "If this is valid, it verifies the RRSIG for the DNSKEY RRset with the DNSKEY created by the key-signing key."
  17: "When all of this is done, the resolver is sure it can trust the values for the A records returned by the authoritative server."
  18: "This is all great, but now we're now facing more issues."
  19: "DNS is hierarchical. Trusting one zone doesn't mean we can trust the parent or the child zone."
  20: "We know we can trust the A records on www.dnsimple.com, but what about the parent and children?"
  21: "The key-signing key is signed by itself. What if it was compromised?"

ep4:
  title: "DNSSEC's Chain of Trust: How the DS Record Connects Parent and Child Zones"
  description: "Learn how DNSSEC uses the DS record to establish trust from parent to child zones. Discover how resolvers validate DNSKEYs, detect tampering, and maintain a secure DNS hierarchy."
  1: "We mentioned that DNS is hierarchical."
  2-1: "When a resolver needs to query the A records for dnsimple.com, it needs to first ask the root where to find the .com servers."
  2-2: "* A character from the comic HowDNS.works"
  3-1: "Then the .com servers will point the resolver to the authoritative name servers for dnsimple.com"
  3-2: "* Another character from the comic HowDNS.works"
  4-1: "Finally, the authoritative server will respond with the IP address for the A records for dnsimple.com."
  4-2: "* Yet another character from the comic HowDNS.works, but you knew that already."
  5: "All of this is based on a **chain of trust**."
  6: "In each iteration with another server, the resolver trusts that it's being redirected from a trusted parent to a trusted child."
  7: "In the DNSSEC world, this is accomplished by a new record type called a **delegation signer** (DS)"
  8: "The DS record is generated on the child zone and given to the parent zone."
  9: "The DS record contains the public portion of the key-signing stored in the DNSKEY record hashed by your DNS provider."
  10: "This DS record needs to be present at the parent zone."
  11: "When the DNS resolver queries the child zone, the parent zone gives the resolver the DS record."
  12: "This serves 2 purposes:"
  13: "First, the resolver is now aware that the child zone is configured with DNSSEC."
  14: "Second, the resolver can check that the unencrypted DS record on the parent zone matches the DNSKEY on the child zone."
  15: "The resolver re-hashes the child's DNSKEY and compares that output to the DS record"
  16: "If they don't match, the resolver knows the zone has been tampered with."
  17: "If they match, the resolver now can trust dnsimple.com"
  18: "We now know that we can trust DNSimple. But what about .com and the root?"

ep5:
  title: "DNSSEC at the Root: Human-Led Signing Ceremonies and the Chain of Trust"
  description: "Discover how the root zone's key-signing ceremony, anchored by real-world humans, secures the entire DNS hierarchy. Learn how DS records, KSKs, and ZSKs together form DNSSEC's unbreakable chain of trust."
  1: "As we travel through the hierarchy of child to parent zones to find out if the DS record is trusted, we'll end up at the top of the hierarchy where no computers are allowed."
  2: "The root zone is the last parent with a DS record."
  3: "The DNSKEY record created by the key-signing key on the root zone is self verified. But who established trust in this record?"
  4: "**HUMANS!**"
  5: "The root signing ceremony is an event where humans come together to celebrate the rotation of the top DNSKEY key and sign it."
  6: "It happens 4 times a year."
  7: "All of this is done in a secure location with a high degree of scrutiny by auditing firms."
  8: "Humans participating in the ceremony can only perform a few actions, ensuring that even if there was a group of evil-doers, they would not be able to compromise the event."
  9: "The result of that ceremony is a **new RRSIG record** that can be used to verify the DNSKEY at the root."
  10: "Let's walk through the chain of trust together, starting at the root."
  11: "When you navigate to dnsimple.com, the DNS resolver will ask the root for the location of the .com server."
  12: "The DNS resolver will assume that the DNSKEY for the key-signing key at the root is trusted because it has been generated by humans."
  13: "Now that we trust the root zone's key (thanks, mysterious humans in the root-signing ceremony!), we can verify .com, then dnsimple.com, and finally www.dnsimple.com"
  14: "If any link in the chain fails, like if a DS record doesn't match the DNSKEY, DNSSEC alerts the resolver."
  15: "The resolver then refuses to pass along the untrusted answer to your device."
  16: "It's basically a big **Access Denied** sign to malicious crabs, tampered-with data, or incompetent villain hackers."
  17: "So that's DNSSEC in a nutshell"
  18: "Zone-signing keys sign the data."
  19: "Key-signing keys sign the zone-signing keys."
  20: "DS records in the parent zone attest to a child zone's authenticity."
  21: "The root zone is validated by real-world humans, ensuring the entire DNS tree is anchored in trust."
  22: "Now that you've seen how it all works, go forth and secure your domains with DNSSEC!"
  23: "The DNS world will be a safer place, no matter how many crabs try to tamper with your traffic!"
  24: "Ready to test your DNSSEC skills? Jump into our text adventure now and see if you can outsmart every threat in the DNS realm!"
  25: "Play the game"

game:
  intro:
    title: "DNSSEC Adventure: A Text Adventure Game"
    description: "What is DNSSEC and how does it work? Brace yourself for a thrilling quest through the digital realm, where you'll master DNSSEC concepts in an interactive story format."
    1: "DNSSEC"
    2: "A text adventure game"
    3: "Brace yourself for a cryptic quest! One bad 'dig' and you'll be lost in the zone! In this DNSSEC text adventure, your fate is signed, or sealed."
    4: "Play"
  buttons:
    next: "Next"
    try_again: "Try again"
    visit_dnsimple: "Explore DNSimple"
    more_comics: "Read more comics"
    inventory: "Inventario"
  inventory:
    close_button: "Close Inventory"
    mission:
      name: "Resolve www.dnsimple.com"
      accomplished: "Accomplished"
      in_progress: "In progress"
    knowledge:
      1: "Historical logs about DNSSEC"
      2: "Solved Chain of Trust riddle"
      3: "Resolved the RRSIG riddle"
      4: "Cracked the Zone-Signing key riddle"
      5: "Sorted out the DS record riddle"
      6: "Solved the Root Key Signing Ceremony riddle"
      7: "Addressed the new RRSIG creation riddle"
    items:
      1: "DNSSEC Root Key"
      2: "DS record for dnsimple.com"
      3: "NS record for dnsimple.com"
      4: "IP address for www.dnsimple.com"
  page1:
    title: "DNSSEC Adventure: The Awakening of the Resolver"
    description: "Awaken in the digital darkness as the heroic Resolver, ready to bridge names to numbers. Your first query calls—will you heed its call?"
    1: "You wake up in the digital darkness, quiet except for the gentle hum of waiting queries."
    2: "You're **Resolver**, the digital hero connecting website names to their numeric homes. Suddenly, your circuits buzz. A query just arrived!"
  page2:
    title: "DNSSEC Adventure: The First Query"
    description: "A new request arrives: Resolve www.dnsimple.com. Step into your role as Resolver and embark on a journey through the DNS universe."
    1: "Resolve **www.dnsimple.com**."
  page3:
    title: "DNSSEC Adventure: Entering the Root Zone"
    description: "Spin up your protocols and prepare to dive into the Root Zone, the oldest and most fortified realm in the DNSSEC world."
    1: "Time to get to work. Protocols spin up inside you."
    2: "To securely find the answer, you'll need to venture into unknown digital territory."
    3: "Your first stop is the **Root Zone**, the oldest and most protected place in the DNS universe."
  page4:
    # No longer exists
  page5:
    title: "DNSSEC Adventure: The Mysterious Chamber"
    description: "Explore a dim, mysterious chamber filled with cryptic signals, a blinking console, and a locked Gate. Which path will you choose?"
    1: "You find yourself in a dim digital room, full of mystery. You see:"
    2: "A shadowy corner sending out weird signals."
    3: "A transparent console blinking softly."
    4: "A sealed doorway labeled 'Guardian's Gate.'"
    5: "What do you want to do?"
    6: "Check out the corner with weird signals"
    7: "Play around with the blinking console"
    8: "Try to open the Guardian's Gate"
  page6:
    title: "DNSSEC Adventure: Corrupted Data Alert"
    description: "Suddenly, you're hit with corrupted data packets! An alarm sounds, and your circuits freeze—will you make it out?"
    1: "Uh-oh, corrupted data packets! An alarm sounds, freezing your circuits."
    2: "Connection terminated."
  page7:
    title: "DNSSEC Adventure: Unlocking the Guardian's Gate"
    description: "Discover critical DNSSEC logs and harness your new knowledge to unlock the Guardian's Gate. The path forward awaits!"
    1: "You read historical logs about DNSSEC on the console &mdash; handy info!"
    2: "The Guardian's Gate senses your readiness and unlocks itself."
    3: "Go through the gate"
  page8:
    title: "DNSSEC Adventure: Gate of Preparation"
    description: "The Guardian's Gate refuses to open. A cryptic voice insists on preparation. Can you prove yourself and move forward?"
    1: "The gate won't budge. A gentle voice whispers, 'Preparation first, resolver.'"
  page9:
    title: "DNSSEC Adventure: A Surprise Named Taco"
    description: "Passing through the Guardian's Gate, you meet a shimmering figure, turns out it's Taco. A friendly face, or just the next challenge?"
    1: "Passing through the Guardian's Gate, you meet the Guardian, a shimmering digital being."
    2: "Oh, wait, it's just Taco!"
  page10:
    title: "DNSSEC Adventure: Taco's Riddle of Authenticity"
    description: "Face Taco's puzzle: “In DNSSEC, I ensure authenticity; a chain unbroken from root to leaf.” Can you solve it and proceed to the Root Server?"
    1: "'Resolver, before entering the Root Server's room, you've gotta answer my **riddle**,' Taco says with a grin."
    2: "In DNSSEC, I ensure authenticity; a chain unbroken from root to leaf. What am I?"
    3: "What's your answer?"
    4: "DNSSEC Chain of Trust"
    5: "Zone-signing keys"
    6: "DS Records"
    7: "Try to sneak past Taco into the Root Server chamber"
  page11:
    title: "DNSSEC Adventure: Triumph at Taco's Gate"
    description: "Taco declares your answer correct, opening the path to the Root chamber. Secure your DNS future by venturing deeper into the DNSSEC world."
    1: "**Correct!** Taco cheers."
    2: "Enter the Root chamber"
  page12:
    title: "DNSSEC Adventure: Zone-Signing Key Misstep"
    description: "Taco rejects your answer, reminding you that a ZSK only signs DNS records within a zone. Learn from this misstep—then try again."
    1: "'Nope,' Taco shakes his head. 'Not quite.'"
    2: "A Zone-Signing Key (ZSK) signs each DNS record within a zone, helping ensure authenticity, but isn't the entire chain of trust itself."
    3: "Connection terminated."
  page13:
    title: "DNSSEC Adventure: DS Record Isn't Everything"
    description: "You guessed DS Records, but Taco sighs. While DS connects parent and child zones, it's still not the complete chain of trust."
    1: "'Incorrect,' Taco sighs."
    2: "A DS Record connects DNSSEC trust between parent and child zones but isn't the complete chain itself."
    3: "Connection terminated."
  page14:
    title: "DNSSEC Adventure: Unauthorized Entry Denied"
    description: "Attempting to bypass Taco's riddle triggers a strict protocol block. Your connection is terminated—heed the rules or face the consequences."
    1: "'Respect the protocol! Unauthorized entry blocked,' Taco warns."
    2: "Connection terminated."
  page15:
    title: "DNSSEC Adventure: Enter the Heart of the Root Zone"
    description: "Dive deeper into the Root Zone's core, where the digital aura grows strong. Prepare for your next encounter with the formidable Root Server."
    1: "You're now deep in the heart of the Root Zone, feeling the digital power all around."
    2: "Suddenly, the Root Server itself appears, grand and authoritative."
  page16:
    title: "DNSSEC Adventure: The Root Server Speaks"
    description: "A grand voice resonates through the Root Zone. The Root Server acknowledges your journey yet warns that deeper knowledge is needed."
    1: "The Root Server speaks:"
    2: "'Resolver, you've come far, but true security takes deeper knowledge.'"
  page17:
    title: "DNSSEC Adventure: The Root Server's Riddle"
    description: "Confront a pivotal challenge from the Root Server. Which DNSSEC record provides encrypted proof and secures integrity?"
    1: "It poses a challenge:"
    2: "In DNSSEC validation, my signature proves validity. Encrypted proof I provide, ensuring integrity. What's my name?"
    3: "Your response?"
    4: "NS Record"
    5: "DNSKEY Record"
    6: "RRSIG Record"
    7: "Try grabbing the DNSSEC key by force"
  page18:
    title: "DNSSEC Adventure: NS Record Misunderstanding"
    description: "Guessing NS Record for the Root Server's riddle falls short. Learn why NS only points to name servers, offering no cryptographic proof."
    1: "The Root Server sighs. 'Wrong, sorry.'"
    2: "NS Records just point you to name servers, they don't have signatures or prove integrity."
    3: "Connection terminated."
  page19:
    title: "DNSSEC Adventure: DNSKEY Not the Signature"
    description: "DNSKEY holds public keys but doesn't sign data. A wrong guess leads to disconnection. Are you ready to try again?"
    1: "The Root Server shakes his head. 'Misunderstanding detected.'"
    2: "DNSKEY records hold public keys but don't provide signatures themselves."
    3: "Connection terminated."
  page20:
    title: "DNSSEC Adventure: Victory and the Root Key"
    description: "Your correct answer earns the authoritative DNSSEC Root Key, allowing you to validate future queries securely. Onward, Resolver!"
    1: "'Well done,' says the Root Server warmly. 'You got it!'"
    2: "You're given the authoritative DNSSEC Root Key."
    3: "Now you can securely validate future queries."
  page21:
    title: "DNSSEC Adventure: Security Violation at the Root"
    description: "An alarmed Root Server denies access for violating protocol. Your session is terminated—heed its warning."
    1: "'Security violation detected!' shouts the Root Server. 'Access denied.'"
    2: "Connection terminated."
  page22:
    title: "DNSSEC Adventure: A Portal to .COM"
    description: "Step through a gateway leading to the .COM TLD server. What new challenges lie ahead in this digital realm?"
    1: "You step into a portal that takes you to the .COM TLD server."
  page23:
    title: "DNSSEC Adventure: Taco's Next Riddle"
    description: "Reunite with Taco at the .COM TLD. Answer a cryptic puzzle about DNSSEC keys to prove you're prepared for the next step."
    1: "On the other side, Taco greets you again."
    2: "'Nice job securing the DNSSEC Root Key! But there's more to learn before reaching .COM,' Taco smiles."
    3: "Taco's next **riddle**:"
    4: "I guard each record within my realm, my cryptographic seal keeps impostors at bay. Lesser in stature than my sibling above, yet crucial to DNSSEC day after day. Who am I?"
    5: "Taco waits for your answer."
    6: "DS Record"
    7: "Zone-Signing Key (ZSK)"
    8: "Key-Signing Key (KSK)"
  page24:
    title: "DNSSEC Adventure: DS Record Falls Short"
    description: "Taco frowns at your DS guess—helpful for parent-child trust, but not for signing each zone record."
    1: "'Not quite,' Taco frowns."
    2: "DS records link parent to child but don't directly sign data within the child zone. They aren't what the riddle described."
  page25:
    title: "DNSSEC Adventure: ZSK Identified"
    description: "Your correct answer impresses Taco. Venture into the .COM TLD chamber, one step closer to your goal."
    1: "'That's right!' Taco nods happily."
    2: "Head into the .COM TLD chamber"
  page26:
    title: "DNSSEC Adventure: KSK Misstep"
    description: "Taco sighs—KSKs sign DNSKEY sets, not individual records. Your quest falters. Try again."
    1: "'Nope, sorry,' Taco sighs."
    2: "The Key-Signing Key (KSK) signs DNSKEY records, not each individual record like the ZSK does."
  page27:
    title: "DNSSEC Adventure: The Vast .COM TLD"
    description: "Arrive in a colossal .COM chamber teeming with delegations. The DS and NS records for dnsimple.com lie just beyond."
    1: "You arrive in the massive .COM TLD chamber, filled with endless delegations."
    2: "The .COM TLD itself appears, towering above."
    3: "You sense you're close to the DS and NS records for dnsimple.com, but there's one final barrier."
  page28:
    title: "DNSSEC Adventure: Prove Delegation Knowledge"
    description: "The .COM TLD challenges you with another DNSSEC riddle. Show your mastery of DS records or risk denial."
    1: "'Prove you understand DNSSEC delegation first,' says the .COM TLD."
    2: "Solve this **riddle**:"
    3: "My cryptographic hint ensures each child inherits trust, placed in a parent's zone so illusions are robust. I link the chain from top to domain beneath. Without me, child claims remain an unverified wreath. Who am I?"
    4: "DS Record"
    5: "DNSKEY Record"
    6: "NS Record"
  page29:
    title: "DNSSEC Adventure: DS Record Confirmed"
    description: "Your correct DS answer impresses the .COM server. It reveals dnsimple.com's DS and NS records, opening a new portal."
    1: "'Exactly,' the .COM server smiles."
    2: "A DS Record links trust from parent to child zones."
    3: "The server reveals the DS and NS records for dnsimple.com."
    4: "A new portal opens, step through!"
  page30:
    title: "DNSSEC Adventure: DNSKEY Doesn't Link Parent and Child"
    description: "Your guess of DNSKEY was off. Taco reminds you it doesn't connect domain zones—that's the DS record's job."
    1: "'Oops, not this time,' .COM says gently."
    2: "DNSKEY records hold public keys for validating signatures. But they don't directly link a child zone to a parent, that's the DS record's job."
    3: "Connection terminated."
  page31:
    title: "DNSSEC Adventure: NS Not a Security Record"
    description: "NS records merely point to servers. Lacking security signatures, they can't fulfill the riddle's requirement."
    1: "'That's a miss,' .COM notes."
    2: "NS records point out authoritative servers, but they don't provide security signatures themselves."
    3: "Connection terminated."
  page32:
    title: "DNSSEC Adventure: Arrival at DNSimple's Trusty"
    description: "Fueled by DS records from .COM, you head for DNSimple's authoritative server. Trusty awaits to test your DNSSEC resolve."
    1: "Boosted by the DS records from .COM, you're confidently charting a secure path forward."
    2: "A faint glow signals your arrival at the DNSimple authoritative name server, known affectionately as **Trusty**."
    3: "The chamber gleams with meticulously coded patterns, each showing authority over **dnsimple.com**."
    4: "'You've traveled far, Resolver,' whispers a friendly voice from the glowing walls."
    5: "Step closer to the entrance"
  page33:
    title: "DNSSEC Adventure: Another Taco Challenge"
    description: "Taco emerges once more with a rare DNSSEC ritual puzzle. Can you identify the ceremony that anchors the root's trust?"
    1: "Taco appears again, radiating quiet alertness."
    2: "'Before you meet Trusty, let's make sure you've really got this,' Taco says playfully."
    3: "Energy sparks as Taco gives you another **riddle**:"
    4: "In DNSSEC's world, I'm not your everyday routine, but a sacred ritual rarely seen. My guardians gather, keys in hand, securing trust across the land. Humans, not machines, keep watchful eyes, protecting trust beneath digital skies. What am I?"
    5: "Zone-Signing Key (ZSK) Rotation"
    6: "DNSSEC Root Key Signing Ceremony"
    7: "DS Ceremony"
  page34:
    title: "DNSSEC Adventure: ZSK Rotation Isn't Rare Enough"
    description: "Taco dismisses your ZSK rotation guess—it's routine and automated, unlike the special root-level ceremony."
    1: "'Nope,' Taco gently corrects."
    2: "ZSK rotation is routine and usually automated, not the special human-driven ceremony the riddle hints at, which happens only for the root key."
  page35:
    title: "DNSSEC Adventure: Root Key Signing Ceremony"
    description: "Correct! The rare, human-led root key signing ensures DNSSEC's highest integrity. Taco beams at your insight."
    1: "'That's it!' Taco smiles broadly."
    2: "The DNSSEC Root Key Signing Ceremony is a rare event where trusted key-holders physically meet to secure the root key using secure hardware. It ensures the root key's integrity and trustworthiness."
  page36:
    title: "DNSSEC Adventure: No Such Thing as a DS Ceremony"
    description: "Taco gently clarifies that DS links parent and child zones, but lacks the formal ceremony unique to root key signing."
    1: "'Incorrect,' Taco clarifies kindly."
    2: "There's no formal 'DS Ceremony.' DS records simply link parent and child zones. The **riddle** describes the unique, ceremonial process at the root key level."
  page37:
    title: "DNSSEC Adventure: Entering Trusty's Chamber"
    description: "Meet the powerful yet reassuring DNSimple authoritative server. One final riddle stands between you and total DNSSEC victory."
    1: "You enter Trusty's chamber, humming with digital authority."
    2: "Shimmering DNS records surround you, each cryptographically secured."
    3: "Trusty stands calmly at the center, powerful yet reassuring."
    4: "'Almost there, Resolver,' Trusty says warmly. 'One final question remains.'"
    5: "When careful hands converge under lock and key, crafting cryptographic proof at the root's decree. From this highest trust, authenticity flows free. What emerges to confirm the guarantee?"
    6: "A new RRSIG record"
    7: "A new DNSKEY record"
    8: "A new DS record"
  page38:
    title: "DNSSEC Adventure: RRSIG Creation Confirmed"
    description: "You've nailed the last riddle. New RRSIG records secure DNSKEY sets for global validation—your quest nears its end."
    1: "'You nailed it,' says Trusty."
    2: "During the ceremony, trusted individuals sign the DNSKEY RRset, creating a new RRSIG record. This new signature allows resolvers worldwide to verify authenticity."
  page39:
    title: "DNSSEC Adventure: DNSKEY Alone Isn't Proof"
    description: "Trusty corrects you: DNSKEY provides the key, but the signature (RRSIG) is what proves authenticity."
    1: "'Not quite,' Trusty gently corrects."
    2: "The DNSKEY itself is just the public key. The ceremony's key creation is actually the RRSIG, the cryptographic seal verifying the DNSKEY set."
  page40:
    title: "DNSSEC Adventure: DS Record Not at the Root"
    description: "A DS record can't exist above the root. Trusty clarifies the chain stops at the root's signature—no parent zone remains."
    1: "'That's off-target,' Trusty explains patiently."
    2: "A DS record connects child zones to parents, but the root has no parent."
  page41:
    title: "DNSSEC Adventure: Mission Accomplished"
    description: "Your heroic journey ends with the IP address for www.dnsimple.com. Congratulations, Resolver—share your triumph with the world!"
    1: "You've done it!"
    2: "The room's data streams clear, showing your goal: Here's the IP address for www.dnsimple.com:"
    3: "**127.0.0.1**"
    4: "You return home victorious. **Nice work, Resolver**!"
    5: "The team at DNSimple hopes that you enjoyed this little adventure. Share it with your friends, explore more of what DNSimple has to offer, and contact us if you have any feedback!"
  failed:
    1: "Unfortunately, you've failed your mission :("
    2: "Your resolver's journey has come to an abrupt end, leaving the DNS quest unfinished."
    3: "Better luck next time!"
    4: "Restart the game"
