State diagram for DNSsec key lifecycle

Mark Andrews marka at
Fri Feb 10 00:57:21 UTC 2012

You don't submitt the initial DS until the KSK is active and any old
state about the DNSKEY as clear caches.  I recommend "activate" +
"publish" at the same time.

Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka at

More information about the bind-users mailing list