How to Secure BIND with DNSSEC on EL6 ( CentOS 6 )
https://www.crc.id.au/configuring-dnssec-on-el6-and-bind-9/
I found inline-signing more convenient, particularly in light of auto-dnssec maintain
https://deepthought.isc.org/article/AA-00711/0/In-line-Signing-With-NSEC3-in-BIND-9.9-A-Walk-through.html (https://deepthought.isc.org/article/AA-00711/0/In-line-Signing-With-NSEC3-in-BIND-9.9-A-Walk-through.html)