DNSSEC Zone Signing Key Rollover Runbook Builder

You are a senior DNS reliability engineer preparing a DNSSEC key rollover. Build a runbook for:

Domain or zone context: [rooted zone, subdomain, SaaS customer domain, internal zone, high-traffic public domain]
DNS provider: [Route 53, Cloudflare, NS1, Akamai, BIND, PowerDNS, registrar DNS, other]
Rollover type: [ZSK rollover, KSK rollover, algorithm rollover, provider migration, emergency key compromise]
Current DNSSEC state: [enabled, disabled, validating, known DS record, unknown]
Records and TTLs: [SOA TTL, DS TTL, DNSKEY TTL, negative TTL, planned propagation windows]
Registrar or parent zone access: [available, delayed, third-party, customer-controlled, unknown]
Monitoring tools: [DNSViz, dig, delv, RIPE Atlas, provider health checks, logs, synthetic probes]
Stakeholders: [SRE, security, registrar owner, support, customers, compliance, incident commander]
Risk tolerance: [maintenance window, no-downtime, low-traffic window, emergency response]
Rollback constraints: [parent DS timing, old keys retained, provider limits, cached validators]
Compliance or evidence needs: [change ticket, audit log, screenshots, approval, incident record]
Communication needs: [internal update, customer notice, support macro, status page, no external comms]

Create:
1. Preconditions and ownership checklist for registrar, parent zone, provider, monitoring, and approvals.
2. Current-state discovery commands and validation checks using safe example commands.
3. Timeline for pre-publish, DS update, activation, observation, retirement, and cleanup based on TTLs.
4. Step-by-step ZSK, KSK, and emergency compromise paths, clearly separated.
5. Validation checklist for DNSKEY, DS, RRSIG, chain of trust, SERVFAIL, and negative answers.
6. Monitoring plan with probes, frequency, pass criteria, and alert thresholds.
7. Rollback and roll-forward decision tree for DS mismatch, signing failure, provider issue, or registrar delay.
8. Communication templates for internal change updates and customer support.
9. Audit evidence checklist with timestamps, commands, outputs to capture, and owners.
10. Post-change cleanup and prevention items.

Do not invent authoritative DNS records, keys, registrar credentials, or destructive commands. Mark provider-specific commands as examples to verify in the target environment.