diff --git a/lib/dns/sec/dst/include/dst/dst.h b/lib/dns/sec/dst/include/dst/dst.h
index 077ec4cb69..4ba113f6b8 100644
--- a/lib/dns/sec/dst/include/dst/dst.h
+++ b/lib/dns/sec/dst/include/dst/dst.h
@@ -48,6 +48,18 @@ typedef void *		dst_context_t;
 				 DST_SIGMODE_UPDATE | \
 				 DST_SIGMODE_FINAL)
 
+/* Key protocol octet values. */
+#define DST_KEYPROTO_TLS	1
+#define DST_KEYPROTO_EMAIL	2
+#define DST_KEYPROTO_DNSSEC	3
+#define DST_KEYPROTO_IPSEC	4
+
+/* Key flag values. */
+#define DST_KEYFLAG_NOAUTH	0x00008000
+#define DST_KEYFLAG_NTMASK	0x00000300
+#define DST_KEYFLAG_NTSHIFT	8
+#define DST_NAMTYP_ZONE		0x02
+
 /* A buffer of this size is large enough to hold any key */
 #define DST_KEY_MAXSIZE		1024
 
@@ -289,6 +301,9 @@ dst_key_id(const dst_key_t *key);
 isc_boolean_t
 dst_key_isprivate(const dst_key_t *key);
 
+isc_boolean_t
+dst_key_iszonekey(const dst_key_t *key);
+
 /* Computes the size of a signature generated by the given key.
  *
  * Requires: