this is a short run-down of setting up dnssec, openpgpkey, dane and sshfp records if you already have a working bind installation
if you need a secondary DNS server that supports DNSSEC (the chances are high if you are not hosting two DNS servers yourself), take a look at https://freedns.afraid.org/ - it's free for basic usage (which is absolutely enough) and works like a charm!