Root zone DNSSEC KSK rollover event - 2018/10/11, 16:00 UTC

[Ray Bellis]

On 28/09/2018 10:55, Anand Buddhdev wrote:

> On 11 October, the old key won't be removed. On that day, the new key
> will start signing the DNSKEY RRset. The old key (id 19036), will remain
> in the root zone; it just won't sign the DNSKEY RRset. Eventually, in
> the first quarter of 2019, it will be revoked, and then removed *after*
> the hold-down period.

My apologies to the list, Anand is correct!  I had misremembered which
phase of the roll we were in, getting confused by just how long KSK2017
has already been in the root zone for.

The guidance in our KB articles still stands, though. :)

kind regards,

Ray