TKEY Exchange (GSS-TSIG hook) Kea D2 server Kea D2 server DNS server DNS server TKEY request TKEY response (signed)