Introduction \r\n Along with its DDoS resilience and impressive global footprint, Akamai Edge DNS offers zone administrators additional technical flexibility and implementation options to improve performance and simplify DNS operations. One example is zone apex mapping (ZAM), a feature that enables top level hostnames (e.g., akamai.com) to resolve directly to an Akamai edge IP. The popularity and appeal of ZAM do, however, prompt a number of questions about the technical specifics, such as: Is ZAM interoperable with DNSSEC? The short answer is yes: Outside of a few caveats that we will explore later in this article, Edge DNS zones can be authenticated with DNSSEC and retain the performance benefits of ZAM. We'll explore the details of each feature and the interoperability limitations in the sections below.  \r\n Zone apex mapping \r\n The Internet Engineering Task Force (IETF) specification requires a domain name's zone apex to resolve to either an A or AAAA record in public DNS.…