auto-dnssec maintain and DNSKEY removal

Mathew Ian Eis Mathew.Eis at
Fri Jul 1 23:03:52 UTC 2016


The documentation for auto-dnssec maintain suggests that named will remove DNSKEYs from zones when the deletion time marked in the metadata occurs [1]. Unfortunately, it seems this is not always the case.

We are currently trying to diagnose the source of residual DNSKEYs in our zones - despite our use of auto-dnssec maintain.

We think that in some cases, named may be choosing to use a key past the removal date (as in [2]), while our file maintenance process removes the keys as per their deletion date – after which named no longer has the necessary metadata to determine whether or not to remove the DNSKEY from the zone.

Does this sound possible? Are there any other circumstances that would lead named to not removed a DNSKEY in a timely manner?

Lastly, so long as a zone is properly signed with a different key, are there any concerns with manually removing the zombie DNSKEY records via an update even while auto-dnssec maintain is enabled?

Thanks in advance,

Mathew Eis
Northern Arizona University
Information Technology Services

auto-dnssec maintain … will also automatically adjust the zone's DNSKEY records on schedule according to the keys' timing metadata.

It may also be necessary for some keys to be used past their end date.  An example of this would be if a key is added but no following key is provided.  Rather than break the zone, the older key may continue to be used, with sufficient notification in the log files to indicate this is happening.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the bind-users mailing list