Inline-signing / dnssec-policy: Signed SOA serial diverges from source serial causing monitoring warnings

[marka]

And yes this works for signed time regardless of whether it is ones complement or
twos complement.

> On 22 Jul 2026, at 12:06, marka <marka at isc.org> wrote:
> 
> Yes.  Serial numbers use modulo arithmetic.  See RFC 1982.  The value is just entered
> as: serial = time % (2^32) with checks to ensure it is monotonically increasing on each
> change which allows for more than one change per second.
> 
>> On 22 Jul 2026, at 03:00, Paul Kosinski via bind-users <bind-users at lists.isc.org> wrote:
>> 
>> So BIND's UnixTime, being represented in decimal, allows values beyond 2^32-1 without any problem?
>> 
>> 
>> On Tue, 21 Jul 2026 18:36:53 +0200
>> Ondřej Surý <ondrej at isc.org> wrote:
>> 
>>> Hi Ajay,
>>> 
>>> switch to unixtime serial number and the problem goes away. You will also get
>>> a one-second granularity for the updates as free bonus. The YYYYMMDDNN
>>> only allows 100 updates per-day.
>>> 
>>> Ondrej
>>> --
>>> Ondřej Surý (He/Him)
>>> ondrej at isc.org
>> -- 
>> Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list.
> 
> -- 
> Mark Andrews, ISC
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE: +61 2 9871 4742              INTERNET: marka at isc.org
> 
> -- 
> Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list.

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742              INTERNET: marka at isc.org