Windows-to-Debian DNS Migration with KSK setup

I am moving our production DNS from a Windows-based server to a fresh Debian instance running Bind9. The new host needs to be fully authoritative for all current zones, so I will rely on you to extract every record from the Windows server, import them into Bind-compatible zone files, and validate that the answers match bit-for-bit before cut-over.

Once the zones are in place, I also want DNSSEC enabled with a properly generated Key Signing Key (KSK) and Zone Signing Key (ZSK) for each zone. Please configure automatic key rollover and publish the DS records I will provide to my registrar. The goal is a seamless switchover with zero client disruption and clean validation on tools like dig +dnssec, dnsviz, and Verisign’s DNSSEC debugger.

Deliverables
• Debian 12 server with Bind9 installed, hardened, and running as a systemd service
• All existing zones and records migrated and verified
• DNSSEC enabled: KSK/ZSK generated, zones signed, DS records documented
• Step-by-step rollback and rollover procedures in a brief hand-off document
• Final test report showing successful queries and DNSSEC validation for every zone

I will give you SSH access to the new Debian VM and remote access to the Windows DNS console. Please schedule the migration so we can switch the registrar glue at a low-traffic time, and let me know any additional information you need to get started.