Root zone DNSSEC KSK rollover event - 2018/10/11, 16:00 UTC

Ray Bellis ray at
Fri Sep 28 10:22:14 UTC 2018

On 28/09/2018 10:55, Anand Buddhdev wrote:

> On 11 October, the old key won't be removed. On that day, the new key
> will start signing the DNSKEY RRset. The old key (id 19036), will remain
> in the root zone; it just won't sign the DNSKEY RRset. Eventually, in
> the first quarter of 2019, it will be revoked, and then removed *after*
> the hold-down period.

My apologies to the list, Anand is correct!  I had misremembered which
phase of the roll we were in, getting confused by just how long KSK2017
has already been in the root zone for.

The guidance in our KB articles still stands, though. :)

kind regards,


More information about the bind-users mailing list