1. A method of electronically signing domain name system (DNS) records stored in a zone file for an internet DNS zone, the method comprising: electronically accessing a plurality of DNS resource records of a DNS zone stored on one or more DNS servers of a distributed DNS database; generating a plurality of leaf nodes from the plurality of DNS resource records by applying a hash function to the DNS resource records; constructing a recursive hash tree from the plurality of leaf nodes, wherein the recursive hash tree comprises a plurality of nodes, the plurality of nodes comprising a root node and the plurality of leaf nodes, wherein each node of the plurality of nodes comprises either a leaf node or a hash of data comprising one or more child nodes; storing the root node in a DNS key (DNSKEY) resource record for a zone signing key (ZSK) for the zone; publishing, in a DNS resource record signature (RRSIG) resource record, validation data comprising path data from the recursive hash tree, whereby a DNS client validates at least one of the DNS resource records using at least the validation data and the root node; obtaining a hash-based signature on data comprising the ZSK for the zone using a second recursive hash tree, wherein the hash-based signature is not algebraically based; and storing the hash-based signature in an RRSIG resource record associated with the DNSKEY resource record for the ZSK; whereby a DNS client validates the ZSK using at least the hash-based signature from the RRSIG resource record associated with the DNSKEY resource record for the ZSK.