2.3.2.8 msDNS-DNSKEYRecords

The msDNS-DNSKEYRecords attribute value MUST contain the DNSKEY records and all RRSIG records covering type DNSKEY for the root of the zone as specified by [RFC4035].