diff --git a/app/assets/javascripts/application.js b/app/assets/javascripts/application.js
index 95ca30d..65c59c6 100644
--- a/app/assets/javascripts/application.js
+++ b/app/assets/javascripts/application.js
@@ -1,63 +1,72 @@
 // This is a manifest file that'll be compiled into application.js, which will include all the files
 // listed below.
 //
 // Any JavaScript/Coffee file within this directory, lib/assets/javascripts, vendor/assets/javascripts,
 // or vendor/assets/javascripts of plugins, if any, can be referenced here using a relative path.
 //
 // It's not advisable to add code directly here, but if you do, it'll appear at the bottom of the
 // compiled file.
 //
 // Read Sprockets README (https://github.com/sstephenson/sprockets#sprockets-directives) for details
 // about supported directives.
 //
 //= require jquery.min
 //= require jquery_ujs
 //= require bootstrap.min
 //= require typeahead.bundle.min
 //= require_tree .
 
 $(function() {
 
     // Show priority on MX/SRV record only
     $('#record_type').change(function() {
         if ($(this).val() == 'MX') { // MX, default priority 10
             $('#record_prio').parents('div.form-group').removeClass('hidden');
             $('#record_prio').val('10');
         } else if ($(this).val() == 'SRV') { // SRV
             $('#record_prio').val('');
             $('#record_prio').parents('div.form-group').removeClass('hidden');
         } else {
             $('#record_prio').val('');
             $('#record_prio').parents('div.form-group').addClass('hidden');
         }
     });
 
     // Show master only on SLAVE domains
     $('#domain_type').change(function() {
         if ($(this).val() == 'SLAVE') {
             $('#domain_master').parents('div.form-group').removeClass('hidden');
         } else {
             $('#domain_master').parents('div.form-group').addClass('hidden');
         }
     });
 
+    // Disable DNSSEC options
+    $('#domain_dnssec').change(function() {
+        if ($(this).val()== 'true') {
+            $("#dnssec_fieldset").prop('disabled', false)
+        } else {
+            $("#dnssec_fieldset").prop('disabled', true);
+        }
+    });
+
     var searchMembersGroup = $('#js-search-member').data('group');
     var searchMembers = new Bloodhound({
         datumTokenizer: Bloodhound.tokenizers.obj.whitespace('email'),
         queryTokenizer: Bloodhound.tokenizers.whitespace,
         identify: function(obj) { return obj.id; },
         remote: {
             url: '/groups/' + searchMembersGroup + '/search_member.json?q=%QUERY',
             wildcard: '%QUERY'
         }
     });
 
     $('#js-search-member').typeahead({
         hint: true,
         minLength: 2
     }, {
         name: 'members',
         display: 'email',
         source: searchMembers
     });
 });
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 954b3b3..6cdb77e 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -1,65 +1,70 @@
 class ApplicationController < ActionController::Base
   # Prevent CSRF attacks by raising an exception.
   # For APIs, you may want to use :null_session instead.
   protect_from_forgery with: :exception
 
   attr_writer :breadcrumb
   helper_method :admin?
+  helper_method :dnssec?
 
   def admin?
     return false if params.key?('user')
     return false if current_user.nil?
 
     @admin_count ||= begin
                        current_user
                        .groups
                        .where(name: WebDNS.settings[:admin_group]).count
                      end
 
     @admin_count != 0
   end
 
   def admin_only!
     return if admin?
 
     redirect_to root_path, alert: 'Admin only area!'
   end
 
+  def dnssec?
+    WebDNS.settings[:dnssec]
+  end
+
   private
 
   def group
     @group ||= edit_group_scope.find(params[:group_id] || params[:id])
   end
 
   def domain
     @domain ||= edit_domain_scope.find(params[:domain_id] || params[:id])
   end
 
   def record
     @record ||= record_scope.find(params[:record_id] || params[:id])
   end
 
   def show_group_scope
     @show_group_scope ||= current_user.groups
   end
 
   def edit_group_scope
     @edit_group_scope ||= admin? ? Group.all : show_group_scope
   end
 
   def show_domain_scope
     @show_domain_scope ||= Domain.where(group: show_group_scope)
   end
 
   def edit_domain_scope
     @edit_domain_scope ||= admin? ? Domain.all : Domain.where(group: show_group_scope)
   end
 
   def record_scope
     @record_scope ||= domain.records
   end
 
   def notification
     Notification.instance
   end
 end
diff --git a/app/controllers/domains_controller.rb b/app/controllers/domains_controller.rb
index 077ca4c..10950b5 100644
--- a/app/controllers/domains_controller.rb
+++ b/app/controllers/domains_controller.rb
@@ -1,78 +1,86 @@
 class DomainsController < ApplicationController
   before_action :authenticate_user!
 
-  before_action :domain, only: [:show, :edit, :update, :destroy]
-  before_action :group,  only: [:show, :edit, :update, :destroy]
+  before_action :domain, only: [:show, :edit, :edit_dnssec, :update, :destroy]
+  before_action :group,  only: [:show, :edit, :edit_dnssec, :update, :destroy]
 
   helper_method :edit_group_scope
 
   # GET /domains
   def index
     @domains = show_domain_scope.all
   end
 
   # GET /domains/1
   def show
     @record = Record.new(domain_id: @domain.id)
   end
 
   # GET /domains/new
   def new
     @domain = Domain.new(new_domain_params)
   end
 
   # GET /domains/1/edit
   def edit
   end
 
+  # GET /domains/1/edit_dnssec
+  def edit_dnssec
+  end
+
   # POST /domains
   def create
     @domain = Domain.new(domain_params)
 
     if @domain.save
       notify_domain(@domain, :create)
       redirect_to @domain, notice: "#{@domain.name} was successfully created."
     else
       render :new
     end
   end
 
   # PATCH/PUT /domains/1
   def update
     if @domain.update(domain_params)
       notify_domain(@domain, :update)
       redirect_to @domain, notice: "#{@domain.name} was successfully updated."
     else
-      render :edit
+      if domain_params[:dnssec] # DNSSEC form
+        render :edit_dnssec
+      else
+        render :edit
+      end
     end
   end
 
   # DELETE /domains/1
   def destroy
     @domain.destroy
     notify_domain(@domain, :destroy)
     redirect_to domains_url, notice: "#{@domain.name} was successfully destroyed."
   end
 
   private
 
   def group
     domain.group
   end
 
   def new_domain_params
     params.permit(:group_id)
   end
 
   def domain_params
     params.require(:domain).tap { |d|
       # Make sure group id is permitted (belongs to edit_group_scope)
       d[:group_id] = edit_group_scope.find_by_id(d[:group_id]).try(:id)
-    }.permit(:name, :type, :master, :group_id)
+    }.permit(:name, :type, :master, :group_id, :dnssec, :dnssec_parent, :dnssec_parent_authority)
   end
 
   def notify_domain(*args)
     notification.notify_domain(current_user, *args)
   end
 
 end
diff --git a/app/models/domain.rb b/app/models/domain.rb
index a88c911..741813b 100644
--- a/app/models/domain.rb
+++ b/app/models/domain.rb
@@ -1,187 +1,203 @@
 class Domain < ActiveRecord::Base
   class NotAChild < StandardError; end
   self.inheritance_column = :nx
 
   # List all supported domain types.
   def self.domain_types
     [
       'NATIVE',
       'MASTER',
       'SLAVE',
     ]
   end
 
   # List domain types that can be created.
   def self.allowed_domain_types
     domain_types - WebDNS.settings[:prohibit_domain_types]
   end
 
+  # List parent authorities
+  def self.dnssec_parent_authorities
+    WebDNS.settings[:dnssec_parent_authorities]
+  end
+
   belongs_to :group
   has_many :jobs
   has_many :records
   # BUG in bump_serial_trigger
   has_one :soa, -> { unscope(where: :type) }, class_name: SOA
 
   validates :group_id, presence: true
   validates :name, uniqueness: true, presence: true
   validates :type, presence: true, inclusion: { in: domain_types }
   validates :master, presence: true, ipv4: true, if: :slave?
 
+  validates :dnssec, inclusion: { in: [false] }, unless: :dnssec_elegible?
+  validates :dnssec_parent_authority, inclusion: { in: dnssec_parent_authorities }, if: :dnssec?
+  validates :dnssec_parent, hostname: true, if: :dnssec?
+
   after_create :generate_soa
   after_create :generate_ns
 
   after_create :install
   before_save :fire_convert
 
   attr_writer :serial_strategy
 
   state_machine initial: :initial do
     after_transition(any => :pending_install) { |domain, _t| Job.add_domain(domain) }
     after_transition(any => :pending_remove) { |domain, _t| Job.remove_domain(domain) }
     after_transition(any => :pending_signing) { |domain, _t| Job.dnssec_sign(domain) }
     after_transition(any => :wait_for_ready) { |domain, _t| Job.wait_for_ready(domain) }
     after_transition(any => :pending_ds) { |domain, t| Job.dnssec_push_ds(domain, *t.args) }
     after_transition(any => :pending_plain) { |domain, _t| Job.convert_to_plain(domain) }
     after_transition(any => :destroy) { |domain, _t| domain.destroy }
 
     # User events
     event :install do
       transition initial: :pending_install
     end
 
     event :dnssec_sign do
       transition operational: :pending_signing
     end
 
     event :signed do
       transition pending_signing: :wait_for_ready
     end
 
     event :push_ds do
       # TODO: push_ds is triggered on multiple occasions
       # operational: :operational
       transition wait_for_ready: :pending_ds
     end
 
     event :plain_convert do
       transition operational: :pending_plain
     end
 
     event :remove do
       transition operational: :pending_remove
     end
 
     # Machine events
     event :installed do
       transition pending_install: :operational
     end
 
     event :converted do
       transition [:pending_ds, :pending_plain] => :operational
     end
 
     event :cleaned_up do
       transition pending_remove: :destroy
     end
   end
 
+  # Returns true if this domain is elegigble for DNSSEC
+  def dnssec_elegible?
+    return false if slave?
+
+    true
+  end
+
   # Get the zone's serial strategy.
   #
   # Returns one of the supported serial strategies.
   def serial_strategy
     @serial_strategy ||= WebDNS.settings[:serial_strategy]
   end
 
   # Returns true if this a reverse zone.
   def reverse?
     name.end_with?('.in-addr.arpa') || name.end_with?('.ip6.arpa')
   end
 
   # Returns true if this a ENUM zone.
   def enum?
     name.end_with?('.e164.arpa')
   end
 
   # Returns true if this is a slave zone.
   def slave?
     type == 'SLAVE'
   end
 
   # Compute subnet for reverse records
   def subnet
     return if not reverse?
 
     if name.end_with?('.in-addr.arpa')
       subnet_v4
     elsif name.end_with?('.ip6.arpa')
       subnet_v6
     end
   end
 
   def self.replace_ds(parent, child, records)
     parent = find_by_name!(parent)
     fail NotAChild if not child.end_with?(parent.name)
 
     existing = parent.records.where(name: child, type: 'DS')
     recs = records.map { |rec| DS.new(domain: parent, name: child, content: rec) }
 
     ActiveRecord::Base.transaction do
       existing.destroy_all
       recs.map(&:save!)
     end
   end
 
   private
 
   def subnet_v4
     # get ip octets (remove .in-addr.arpa)
     octets = name.split('.')[0...-2].reverse
     return if octets.any? { |_| false }
 
     mask = 8 * octets.size
     octets += [0, 0, 0, 0]
 
     ip = IPAddr.new octets[0, 4].join('.')
 
     [ip, mask].join('/')
   end
 
   def subnet_v6
     nibbles = name.split('.')[0...-2].reverse
     return if nibbles.any? { |_| false }
 
     mask = 4 * nibbles.size
     nibbles += [0] * 32
 
     ip = IPAddr.new nibbles[0, 32].in_groups_of(4).map(&:join).join(':')
 
     [ip, mask].join('/')
   end
 
   # Hooks
 
   def generate_soa
     soa_record = SOA.new(domain: self)
 
     soa_record.save!
   end
 
   def generate_ns
     return if slave?
     return if WebDNS.settings[:default_ns].empty?
 
     WebDNS.settings[:default_ns].each { |ns|
       Record.find_or_create_by!(domain: self, type: 'NS', name: '', content: ns)
     }
   end
 
   def fire_convert
     return if !dnssec_changed?
 
     event = dnssec ? :dnssec_convert : :plain_convert
     return true if fire_state_event(event)
 
     errors.add(:dnssec, 'You cannot modify dnssec settings in this state!')
     false
   end
 end
diff --git a/app/views/domains/_dnssec_form.html.erb b/app/views/domains/_dnssec_form.html.erb
new file mode 100644
index 0000000..534fdb1
--- /dev/null
+++ b/app/views/domains/_dnssec_form.html.erb
@@ -0,0 +1,12 @@
+<%= bootstrap_form_for(@domain, layout: :horizontal, label_col: 'col-sm-2', control_col: 'col-sm-4') do |f| %>
+  <%= f.hidden_field :group_id %>
+  <%= f.static_control :name %>
+  <%= f.select :dnssec, [['Enable', true], ['Disable', false]] %>
+
+  <fieldset id="dnssec_fieldset" <%= 'disabled' if !@domain.dnssec %>>
+    <%= f.select :dnssec_parent_authority, Domain.dnssec_parent_authorities, include_blank: true,
+    label: 'Parent authority', help: 'WebDNS will manage DS records automatically, handling initial setup and key rollovers.' %>
+    <%= f.text_field :dnssec_parent, label: 'Parent zone', help: 'The parent zone to publish the DS records.' %>
+  </fieldset>
+    <%= f.submit 'Save', class: 'btn btn-primary col-sm-offset-2' %>
+<% end %>
diff --git a/app/views/domains/_form.html.erb b/app/views/domains/_form.html.erb
index 6a32f42..90fe862 100644
--- a/app/views/domains/_form.html.erb
+++ b/app/views/domains/_form.html.erb
@@ -1,7 +1,10 @@
 <%= bootstrap_form_for(@domain, layout: :horizontal, label_col: 'col-sm-2', control_col: 'col-sm-4') do |f| %>
   <%= f.text_field :name %>
   <%= f.collection_select :group_id, edit_group_scope, :id, :name %>
   <%= f.select :type, Domain.allowed_domain_types %>
   <%= f.text_field :master, wrapper_class: 'hidden' %>
   <%= f.submit 'Save', class: 'btn btn-primary col-sm-offset-2' %>
+  <% if dnssec? && @domain.dnssec_elegible? %>
+    <%= link_to 'Setup DNSSEC', edit_dnssec_domain_path(@domain), class: 'btn btn-default' %>
+  <% end %>
 <% end %>
diff --git a/app/views/domains/edit_dnssec.html.erb b/app/views/domains/edit_dnssec.html.erb
new file mode 100644
index 0000000..ab62777
--- /dev/null
+++ b/app/views/domains/edit_dnssec.html.erb
@@ -0,0 +1,3 @@
+<h1>DNSSEC for <%= @domain.name %></h1>
+
+<%= render 'dnssec_form' %>
diff --git a/app/views/domains/index.html.erb b/app/views/domains/index.html.erb
index f0229f9..190fbe6 100644
--- a/app/views/domains/index.html.erb
+++ b/app/views/domains/index.html.erb
@@ -1,57 +1,60 @@
 <% if current_user.memberships.empty? %>
   <div class="jumbotron">
     <h2>Wellcome to WebDNS!</h2>
     <p>
       In order to manage domains you have to be a member of a group.
     </p>
     <p>
       You can either contact an admin to create a new group for you, or ask another user for an invite to an existing group.
     </p>
   </div>
 <% end %>
 
 <table class="table table-striped">
   <thead>
   </thead>
 
   <tbody>
     <% @domains.group_by(&:group).each do |group, domains| %>
       <tr>
         <th colspan="2" style="width:800px">
           <%= link_to group.name, group_path(group) %>
           <%= link_to glyph('menu-down'), "##{group.id}", onclick: "$('tr.group-#{group.id}').toggleClass('hidden');" %>
         </th>
         <th>State</th>
         <th colspan="2">Controls</th>
       </tr>
       <% domains.each do |domain| %>
         <tr class="group-<%= group.id =%>">
           <td>
             <% if domain.reverse? %>
               <%= abbr_glyph('chevron-left', 'Reverse') %>
             <% elsif domain.enum? %>
               <%= abbr_glyph('phone-alt', 'Enum') %>
             <% else %>
               <%= abbr_glyph('chevron-right', 'Forward') %>
             <% end %>
             <% if domain.slave? %>
               <%= abbr_glyph('link', 'Slave') %>
             <% end %>
+            <% if domain.dnssec? %>
+              <%= abbr_glyph('flash', 'DNSSEC') %>
+            <% end %>
           </td>
           <td style="width:800px"><%= link_to domain.name, domain %></td>
           <td><%= human_state(domain.state) %></td>
           <td><%= link_to_edit edit_domain_path(domain) %></td>
           <td><%= link_to_destroy domain, method: :delete, data: { confirm: 'Are you sure?' } %></td>
         </tr>
       <% end %>
     <% end %>
   </tbody>
 </table>
 
 <p>
   <% if current_user.memberships.any? %>
     <%= link_to 'Add Domain', new_domain_path, class: 'btn btn-primary' %>
   <% else %>
     <%= link_to 'Add Domain', new_domain_path, class: 'btn btn-primary disabled' %>
   <% end %>
 </p>
diff --git a/app/views/groups/show.html.erb b/app/views/groups/show.html.erb
index 7eee3b4..4d2b300 100644
--- a/app/views/groups/show.html.erb
+++ b/app/views/groups/show.html.erb
@@ -1,82 +1,85 @@
 <% content_for :more_breadcrumbs do %>
   <li>
     <%= link_to_edit edit_admin_group_path(@group) %>
     <%= link_to_destroy admin_group_path(@group), method: :delete, data: { confirm: 'Are you sure?' } %>
   </li>
 <% end if admin? %>
 
 <ul class="nav nav-tabs">
   <li role="presentation" class="active"><a data-toggle="tab" href="#domains">Domains</a></li>
   <li role="presentation"><a data-toggle="tab" href="#members">Members</a></li>
 </ul>
 
 <div class="tab-content">
   <div role="tabpanel" class="tab-pane active" id="domains">
     <table class="table table-striped table-hover">
       <thead>
         <tr>
           <th colspan="2">Domain</th>
           <th>State</th>
           <th colspan="2">Controls</th>
         </tr>
       </thead>
 
       <tbody>
         <% @group.domains.each do |domain| %>
           <tr>
             <td>
               <% if domain.reverse? %>
                 <%= abbr_glyph('chevron-left', 'Reverse') %>
               <% elsif domain.enum? %>
                 <%= abbr_glyph('phone-alt', 'Enum') %>
               <% else %>
                 <%= abbr_glyph('chevron-right', 'Forward') %>
               <% end %>
               <% if domain.slave? %>
                 <%= abbr_glyph('link', 'Slave') %>
               <% end %>
+              <% if domain.dnssec? %>
+                <%= abbr_glyph('flash', 'DNSSEC') %>
+              <% end %>
             </td>
             <td><%= link_to domain.name, domain %></td>
             <td><%= human_state(domain.state) %></td>
             <td><%= link_to_edit edit_domain_path(domain) %></td>
             <td><%= link_to_destroy domain, method: :delete, data: { confirm: 'Are you sure?' } %></td>
           </tr>
         <% end %>
       </tbody>
     </table>
 
     <p>
       <%= link_to 'Add Domain', new_domain_path(group_id: @group.id), class: 'btn btn-primary' %>
     </p>
 
   </div>
 
   <div role="tabpanel" class="tab-pane" id="members">
     <table class="table table-striped table-hover">
       <thead>
         <tr>
           <th>Member</th>
           <th>Controls</th>
         </tr>
       </thead>
 
       <tbody>
         <% @group.memberships.includes(:user).each do |membership| %>
           <tr>
             <td><%= membership.user.email %><%= " (you)" if current_user == membership.user %></td>
             <td>
               <%= link_to_destroy destroy_member_group_path(@group, membership.user_id), method: :delete %>
             </td>
           </tr>
         <% end %>
       </tbody>
     </table>
 
     <p>
       <%= bootstrap_form_tag(url: create_member_group_path(@group), layout: :inline) do |f| %>
         <%= f.text_field :email, prepend: 'Add Member', hide_label: true, id: 'js-search-member', data: { group: @group.id } %>
         <%= f.submit 'Add', class: 'btn btn-primary' %>
       <% end %>
     </p>
   </div>
 </div>
diff --git a/config/initializers/00_settings.rb b/config/initializers/00_settings.rb
index 4134800..44ba3cc 100644
--- a/config/initializers/00_settings.rb
+++ b/config/initializers/00_settings.rb
@@ -1,26 +1,29 @@
 WebDNS.settings[:soa_defaults] = {
   primary_ns: 'ns1.example.com',
   contact: 'domainmaster@example.com',
   serial: 1,
   refresh: 10_800,
   retry: 3600,
   expire: 604_800,
   nx: 3600
 }
 WebDNS.settings[:default_ns] = [
   'ns1.example.com',
   'ns2.example.com'
 ]
 
+WebDNS.settings[:dnssec] = true
+WebDNS.settings[:dnssec_parent_authorities] = ['webdns', 'papaki']
+
 WebDNS.settings[:serial_strategy] = Strategies::Date
 
 WebDNS.settings[:prohibit_records_types] = []
 WebDNS.settings[:prohibit_domain_types] = ['NATIVE']
 
 WebDNS.settings[:contact_mail] = 'webdns@example.com'
 WebDNS.settings[:mail_from] = 'webdns@example.com'
 WebDNS.settings[:admin_group] = 'admin'
 
 # Allow local overrides
 local_settings = File.expand_path('../../local_settings.rb', __FILE__)
 require_relative local_settings if File.exist?(local_settings)
diff --git a/config/routes.rb b/config/routes.rb
index b2e97aa..d6618ce 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -1,44 +1,46 @@
 Rails.application.routes.draw do
   # Override devise user removal
   devise_scope :users do
     delete :users, to: redirect('/')
   end
   devise_for :users
 
   root to: redirect('/domains')
 
   resources :groups, only: [:show] do
     get :search_member,
         to: 'groups#search_member', on: :member
     post :members,
          to: 'groups#create_member', as: :create_member, on: :member
     delete 'member/:user_id',
            to: 'groups#destroy_member', as: :destroy_member, on: :member
   end
 
   resources :domains do
+    get :edit_dnssec, to: 'domains#edit_dnssec', on: :member
+
     resources :records, except: [:index, :show] do
       # Reuse records#update instead of introducing new controller actions
       #
       # rubocop:disable Style/AlignHash
       put :disable, to: 'records#update', on: :member,
           defaults: { record: { disabled: true } }
       put :enable,  to: 'records#update', on: :member,
           defaults: { record: { disabled: false } }
       # rubocop:enable Style/AlignHash
     end
   end
 
   # Admin
   namespace :admin do
     root to: redirect('/admin/groups')
 
     resources :groups, except: [:show]
     resources :jobs, only: [:index, :destroy]
   end
 
   # Private
   put 'private/replace_ds', to: 'private#replace_ds'
   put 'private/trigger_event', to: 'private#trigger_event'
 end
 
diff --git a/db/migrate/20151207054417_add_dnssec.rb b/db/migrate/20151207054417_add_dnssec.rb
new file mode 100644
index 0000000..590b487
--- /dev/null
+++ b/db/migrate/20151207054417_add_dnssec.rb
@@ -0,0 +1,7 @@
+class AddDnssec < ActiveRecord::Migration
+  def change
+    add_column :domains, :dnssec, :boolean, default: false, null: false
+    add_column :domains, :dnssec_parent, :string, default: '', null: false
+    add_column :domains, :dnssec_parent_authority, :string, default: '', null: false
+  end
+end
diff --git a/db/structure.sql b/db/structure.sql
index 92167c5..d240b30 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -1,283 +1,288 @@
 -- MySQL dump 10.15  Distrib 10.0.20-MariaDB, for debian-linux-gnu (x86_64)
 --
 -- Host: localhost    Database: webns
 -- ------------------------------------------------------
 -- Server version	10.0.20-MariaDB-3
 
 /*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */;
 /*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */;
 /*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;
 /*!40101 SET NAMES utf8 */;
 /*!40103 SET @OLD_TIME_ZONE=@@TIME_ZONE */;
 /*!40103 SET TIME_ZONE='+00:00' */;
 /*!40014 SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0 */;
 /*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */;
 /*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;
 /*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */;
 
 --
 -- Table structure for table `comments`
 --
 
 DROP TABLE IF EXISTS `comments`;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
 /*!40101 SET character_set_client = utf8 */;
 CREATE TABLE `comments` (
   `id` int(11) NOT NULL AUTO_INCREMENT,
   `domain_id` int(11) NOT NULL,
   `name` varchar(255) NOT NULL,
   `type` varchar(10) NOT NULL,
   `modified_at` int(11) NOT NULL,
   `account` varchar(40) NOT NULL,
   `comment` mediumtext NOT NULL,
   PRIMARY KEY (`id`),
   KEY `comments_domain_id_idx` (`domain_id`),
   KEY `comments_name_type_idx` (`name`,`type`),
   KEY `comments_order_idx` (`domain_id`,`modified_at`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
 /*!40101 SET character_set_client = @saved_cs_client */;
 
 --
 -- Table structure for table `cryptokeys`
 --
 
 DROP TABLE IF EXISTS `cryptokeys`;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
 /*!40101 SET character_set_client = utf8 */;
 CREATE TABLE `cryptokeys` (
   `id` int(11) NOT NULL AUTO_INCREMENT,
   `domain_id` int(11) NOT NULL,
   `flags` int(11) NOT NULL,
   `active` tinyint(1) DEFAULT NULL,
   `content` text,
   PRIMARY KEY (`id`),
   KEY `domainidindex` (`domain_id`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
 /*!40101 SET character_set_client = @saved_cs_client */;
 
 --
 -- Table structure for table `domainmetadata`
 --
 
 DROP TABLE IF EXISTS `domainmetadata`;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
 /*!40101 SET character_set_client = utf8 */;
 CREATE TABLE `domainmetadata` (
   `id` int(11) NOT NULL AUTO_INCREMENT,
   `domain_id` int(11) NOT NULL,
   `kind` varchar(32) DEFAULT NULL,
   `content` text,
   PRIMARY KEY (`id`),
   KEY `domainmetadata_idx` (`domain_id`,`kind`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
 /*!40101 SET character_set_client = @saved_cs_client */;
 
 --
 -- Table structure for table `domains`
 --
 
 DROP TABLE IF EXISTS `domains`;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
 /*!40101 SET character_set_client = utf8 */;
 CREATE TABLE `domains` (
   `id` int(11) NOT NULL AUTO_INCREMENT,
   `name` varchar(255) NOT NULL,
   `master` varchar(128) DEFAULT NULL,
   `last_check` int(11) DEFAULT NULL,
   `type` varchar(6) NOT NULL,
   `notified_serial` int(11) DEFAULT NULL,
   `account` varchar(40) DEFAULT NULL,
   `group_id` int(11) DEFAULT NULL,
   `created_at` datetime NOT NULL,
   `updated_at` datetime NOT NULL,
   `state` varchar(255) NOT NULL DEFAULT 'initial',
+  `dnssec` tinyint(1) NOT NULL DEFAULT '0',
+  `dnssec_parent` varchar(255) NOT NULL DEFAULT '',
+  `dnssec_parent_authority` varchar(255) NOT NULL DEFAULT '',
   PRIMARY KEY (`id`),
   UNIQUE KEY `name_index` (`name`),
   KEY `index_domains_on_group_id` (`group_id`)
 ) ENGINE=InnoDB AUTO_INCREMENT=37 DEFAULT CHARSET=utf8;
 /*!40101 SET character_set_client = @saved_cs_client */;
 
 --
 -- Table structure for table `groups`
 --
 
 DROP TABLE IF EXISTS `groups`;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
 /*!40101 SET character_set_client = utf8 */;
 CREATE TABLE `groups` (
   `id` int(11) NOT NULL AUTO_INCREMENT,
   `name` varchar(255) DEFAULT NULL,
   `disabled` tinyint(1) DEFAULT '0',
   `created_at` datetime DEFAULT NULL,
   `updated_at` datetime DEFAULT NULL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `index_groups_on_name` (`name`)
 ) ENGINE=InnoDB AUTO_INCREMENT=10 DEFAULT CHARSET=utf8;
 /*!40101 SET character_set_client = @saved_cs_client */;
 
 --
 -- Table structure for table `jobs`
 --
 
 DROP TABLE IF EXISTS `jobs`;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
 /*!40101 SET character_set_client = utf8 */;
 CREATE TABLE `jobs` (
   `id` int(11) NOT NULL AUTO_INCREMENT,
   `job_type` varchar(255) NOT NULL,
   `domain_id` int(11) DEFAULT NULL,
   `args` varchar(255) NOT NULL,
   `status` int(11) NOT NULL DEFAULT '0',
   `retries` int(11) NOT NULL DEFAULT '0',
   `created_at` datetime DEFAULT NULL,
   `updated_at` datetime DEFAULT NULL,
   PRIMARY KEY (`id`),
   KEY `index_jobs_on_domain_id` (`domain_id`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
 /*!40101 SET character_set_client = @saved_cs_client */;
 
 --
 -- Table structure for table `memberships`
 --
 
 DROP TABLE IF EXISTS `memberships`;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
 /*!40101 SET character_set_client = utf8 */;
 CREATE TABLE `memberships` (
   `id` int(11) NOT NULL AUTO_INCREMENT,
   `group_id` int(11) DEFAULT NULL,
   `user_id` int(11) DEFAULT NULL,
   `created_at` datetime DEFAULT NULL,
   `updated_at` datetime DEFAULT NULL,
   PRIMARY KEY (`id`),
   KEY `index_memberships_on_group_id` (`group_id`),
   KEY `index_memberships_on_user_id` (`user_id`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
 /*!40101 SET character_set_client = @saved_cs_client */;
 
 --
 -- Table structure for table `records`
 --
 
 DROP TABLE IF EXISTS `records`;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
 /*!40101 SET character_set_client = utf8 */;
 CREATE TABLE `records` (
   `id` int(11) NOT NULL AUTO_INCREMENT,
   `domain_id` int(11) DEFAULT NULL,
   `name` varchar(255) DEFAULT NULL,
   `type` varchar(10) DEFAULT NULL,
   `content` mediumtext,
   `ttl` int(11) DEFAULT NULL,
   `prio` int(11) DEFAULT NULL,
   `change_date` int(11) DEFAULT NULL,
   `disabled` tinyint(1) DEFAULT '0',
   `ordername` varchar(255) CHARACTER SET utf8 COLLATE utf8_bin DEFAULT NULL,
   `auth` tinyint(1) DEFAULT '1',
   `created_at` datetime NOT NULL,
   `updated_at` datetime NOT NULL,
   PRIMARY KEY (`id`),
   KEY `nametype_index` (`name`,`type`),
   KEY `domain_id` (`domain_id`),
   KEY `recordorder` (`domain_id`,`ordername`),
   CONSTRAINT `records_ibfk_1` FOREIGN KEY (`domain_id`) REFERENCES `domains` (`id`) ON DELETE CASCADE
 ) ENGINE=InnoDB AUTO_INCREMENT=32 DEFAULT CHARSET=utf8;
 /*!40101 SET character_set_client = @saved_cs_client */;
 
 --
 -- Table structure for table `schema_migrations`
 --
 
 DROP TABLE IF EXISTS `schema_migrations`;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
 /*!40101 SET character_set_client = utf8 */;
 CREATE TABLE `schema_migrations` (
   `version` varchar(255) NOT NULL,
   UNIQUE KEY `unique_schema_migrations` (`version`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
 /*!40101 SET character_set_client = @saved_cs_client */;
 
 --
 -- Table structure for table `supermasters`
 --
 
 DROP TABLE IF EXISTS `supermasters`;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
 /*!40101 SET character_set_client = utf8 */;
 CREATE TABLE `supermasters` (
   `ip` varchar(64) NOT NULL,
   `nameserver` varchar(255) NOT NULL,
   `account` varchar(40) NOT NULL,
   PRIMARY KEY (`ip`,`nameserver`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
 /*!40101 SET character_set_client = @saved_cs_client */;
 
 --
 -- Table structure for table `tsigkeys`
 --
 
 DROP TABLE IF EXISTS `tsigkeys`;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
 /*!40101 SET character_set_client = utf8 */;
 CREATE TABLE `tsigkeys` (
   `id` int(11) NOT NULL AUTO_INCREMENT,
   `name` varchar(255) DEFAULT NULL,
   `algorithm` varchar(50) DEFAULT NULL,
   `secret` varchar(255) DEFAULT NULL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `namealgoindex` (`name`,`algorithm`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
 /*!40101 SET character_set_client = @saved_cs_client */;
 
 --
 -- Table structure for table `users`
 --
 
 DROP TABLE IF EXISTS `users`;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
 /*!40101 SET character_set_client = utf8 */;
 CREATE TABLE `users` (
   `id` int(11) NOT NULL AUTO_INCREMENT,
   `email` varchar(255) NOT NULL DEFAULT '',
   `encrypted_password` varchar(255) NOT NULL DEFAULT '',
   `reset_password_token` varchar(255) DEFAULT NULL,
   `reset_password_sent_at` datetime DEFAULT NULL,
   `remember_created_at` datetime DEFAULT NULL,
   `sign_in_count` int(11) NOT NULL DEFAULT '0',
   `current_sign_in_at` datetime DEFAULT NULL,
   `last_sign_in_at` datetime DEFAULT NULL,
   `current_sign_in_ip` varchar(255) DEFAULT NULL,
   `last_sign_in_ip` varchar(255) DEFAULT NULL,
   `created_at` datetime NOT NULL,
   `updated_at` datetime NOT NULL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `index_users_on_email` (`email`),
   UNIQUE KEY `index_users_on_reset_password_token` (`reset_password_token`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40103 SET TIME_ZONE=@OLD_TIME_ZONE */;
 
 /*!40101 SET SQL_MODE=@OLD_SQL_MODE */;
 /*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */;
 /*!40014 SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS */;
 /*!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT */;
 /*!40101 SET CHARACTER_SET_RESULTS=@OLD_CHARACTER_SET_RESULTS */;
 /*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */;
 /*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */;
 
 -- Dump completed on 2015-11-08 12:57:51
 INSERT INTO schema_migrations (version) VALUES ('20151028123326');
 
 INSERT INTO schema_migrations (version) VALUES ('20151028123327');
 
 INSERT INTO schema_migrations (version) VALUES ('20151031184819');
 
 INSERT INTO schema_migrations (version) VALUES ('20151107182656');
 
 INSERT INTO schema_migrations (version) VALUES ('20151108093333');
 
 INSERT INTO schema_migrations (version) VALUES ('20151108105701');
 
+INSERT INTO schema_migrations (version) VALUES ('20151207054417');
+
 INSERT INTO schema_migrations (version) VALUES ('20151207194729');
 
 INSERT INTO schema_migrations (version) VALUES ('20151213102322');