<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>wkumari@lisa:~$ man dnssec-signzone</div><div><br></div><div>[SNIP] </div><div><div> -N soa-serial-format</div><div> The SOA serial number format of the signed zone. Possible formats are "keep" (default), "increment" and "unixtime".</div><div><br></div><div> "keep"</div><div> Do not modify the SOA serial number.</div><div><br></div><div> "increment"</div><div> Increment the SOA serial number using RFC 1982 arithmetics.</div><div><br></div><div> "unixtime"</div><div> Set the SOA serial number to the number of seconds since epoch.</div><div>[SNIP]</div><div><br></div><div>W</div></div><div><br></div><div><br></div><div><br></div><br><div><div>On Jun 7, 2010, at 9:21 AM, rams wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>Hi ,</div> <div> </div> <div>When we resign using "dnssec-signzone -o <zone name> -f <new zone file name> <signed zone file>" , we don't get SOA incremented . In general AXFR looks for SOA comparison to reload zone file. In this case how will AXFR happen?</div> <div> </div> <div> </div> <div>Thanks & Regards,</div> <div>Ramesh</div> <div> </div> <div><br><br> </div> <div class="gmail_quote">On Mon, Jun 7, 2010 at 5:30 PM, <span dir="ltr"><<a href="mailto:bind-users-request@lists.isc.org">bind-users-request@lists.isc.org</a>></span> wrote:<br> <blockquote style="BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex; PADDING-LEFT: 1ex" class="gmail_quote">Send bind-users mailing list submissions to<br> <a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br> <br>To subscribe or unsubscribe via the World Wide Web, visit<br> <a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>or, via email, send a message with subject or body 'help' to<br> <a href="mailto:bind-users-request@lists.isc.org">bind-users-request@lists.isc.org</a><br><br>You can reach the person managing the list at<br> <a href="mailto:bind-users-owner@lists.isc.org">bind-users-owner@lists.isc.org</a><br> <br>When replying, please edit your Subject line so it is more specific<br>than "Re: Contents of bind-users digest..."<br><br><br>Today's Topics:<br><br> 1. .org registrars allowing DS records (itservices88)<br> 2. Re: .org registrars allowing DS records (Kevin Oberman)<br> 3. Re: .org registrars allowing DS records (Doug Barton)<br> 4. Re: .org registrars allowing DS records (Mark Andrews)<br> 5. Re: .org registrars allowing DS records (itservices88)<br> 6. how to resign a zone (rams)<br> 7. Re: how to resign a zone (Alan Clegg)<br><br><br>----------------------------------------------------------------------<br><br>Message: 1<br>Date: Sun, 6 Jun 2010 11:36:43 -0700<br> From: itservices88 <<a href="mailto:itservices88@gmail.com">itservices88@gmail.com</a>><br>Subject: .org registrars allowing DS records<br>To: <a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br> Message-ID:<br> <<a href="mailto:AANLkTimwvWOTH3YIqXUz-v5eQ0YLjbRb9jAZgYL7XEBZ@mail.gmail.com">AANLkTimwvWOTH3YIqXUz-v5eQ0YLjbRb9jAZgYL7XEBZ@mail.gmail.com</a>><br>Content-Type: text/plain; charset="iso-8859-1"<br> <br>I am using <a href="http://godaddy.com/" target="_blank">godaddy.com</a> for my .org domains and as per the customer support<br>replies, they donot support DNSSEC and thus cannot add DS records for my<br>domains.<br><br> Which other registrars people are using that allow DS records.<br><br>Thanks<br>-dani<br>-------------- next part --------------<br>An HTML attachment was scrubbed...<br>URL: <<a href="https://lists.isc.org/pipermail/bind-users/attachments/20100606/d0704f3b/attachment-0001.html" target="_blank">https://lists.isc.org/pipermail/bind-users/attachments/20100606/d0704f3b/attachment-0001.html</a>><br> <br>------------------------------<br><br>Message: 2<br>Date: Sun, 06 Jun 2010 17:14:27 -0700<br>From: "Kevin Oberman" <<a href="mailto:oberman@es.net">oberman@es.net</a>><br>Subject: Re: .org registrars allowing DS records<br> To: itservices88 <<a href="mailto:itservices88@gmail.com">itservices88@gmail.com</a>><br>Cc: <a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br>Message-ID: <<a href="mailto:20100607001427.7E7161CC37@ptavv.es.net">20100607001427.7E7161CC37@ptavv.es.net</a>><br> Content-Type: text/plain; charset=us-ascii<br><br>> I am using <a href="http://godaddy.com/" target="_blank">godaddy.com</a> for my .org domains and as per the customer support<br>> replies, they donot support DNSSEC and thus cannot add DS records for my<br> > domains.<br>><br>> Which other registrars people are using that allow DS records.<br>><br>> Thanks<br>> -dani<br><br>Last I checked, .org, while signed, was not yet accepting DS records from<br>anyone. I suspect that no gtld other than .gov will accept them until the root<br> is signed next month.<br><br>I do know that afilias was certifying registrars and I believe that they will<br>be releasing a list of those registrars that are certified, but that will not<br>mean that they will be accepting them immediately.<br> <br>Until then, <a href="http://dlv.isc.org/" target="_blank">dlv.isc.org</a> is the best (only?) option.<br>--<br>R. Kevin Oberman, Network Engineer<br>Energy Sciences Network (ESnet)<br>Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab)<br> E-mail: <a href="mailto:oberman@es.net">oberman@es.net</a> Phone: +1 510 486-8634<br>Key fingerprint:059B 2DDF 031C 9BA3 14A4 EADA 927D EBB3 987B 3751<br><br><br><br><br>------------------------------<br> <br>Message: 3<br>Date: Sun, 06 Jun 2010 17:24:07 -0700<br>From: Doug Barton <<a href="mailto:dougb@dougbarton.us">dougb@dougbarton.us</a>><br>Subject: Re: .org registrars allowing DS records<br>To: Kevin Oberman <<a href="mailto:oberman@es.net">oberman@es.net</a>><br> Cc: <a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br>Message-ID: <<a href="mailto:4C0C3C27.2050401@dougbarton.us">4C0C3C27.2050401@dougbarton.us</a>><br>Content-Type: text/plain; charset=ISO-8859-1; format=flowed<br> <br>On 06/06/10 17:14, Kevin Oberman wrote:<br>>> I am using <a href="http://godaddy.com/" target="_blank">godaddy.com</a> for my .org domains and as per the customer support<br>>> replies, they donot support DNSSEC and thus cannot add DS records for my<br> >> domains.<br>>><br>>> Which other registrars people are using that allow DS records.<br>>><br>>> Thanks<br>>> -dani<br>><br>> Last I checked, .org, while signed, was not yet accepting DS records from<br> > anyone. I suspect that no gtld other than .gov will accept them until the root<br>> is signed next month.<br>><br>> I do know that afilias was certifying registrars and I believe that they will<br>> be releasing a list of those registrars that are certified, but that will not<br> > mean that they will be accepting them immediately.<br><br>Basically correct, yes. For ORG, keep your eye on the following list:<br><a href="http://www.pir.org/get/registrars" target="_blank">http://www.pir.org/get/registrars</a><br> <br><br>hth,<br><br>Doug<br><br>> Until then, <a href="http://dlv.isc.org/" target="_blank">dlv.isc.org</a> is the best (only?) option.<br><br><br><br>--<br><br> ... and that's just a little bit of history repeating.<br> -- Propellerheads<br><br> Improve the effectiveness of your Internet presence with<br> a domain name makeover! <a href="http://supersetsolutions.com/" target="_blank">http://SupersetSolutions.com/</a><br> <br><br><br>------------------------------<br><br>Message: 4<br>Date: Mon, 07 Jun 2010 11:47:34 +1000<br>From: Mark Andrews <<a href="mailto:marka@isc.org">marka@isc.org</a>><br>Subject: Re: .org registrars allowing DS records<br> To: "Kevin Oberman" <<a href="mailto:oberman@es.net">oberman@es.net</a>><br>Cc: <a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br>Message-ID: <<a href="mailto:201006070147.o571lYLt004983@drugs.dv.isc.org">201006070147.o571lYLt004983@drugs.dv.isc.org</a>><br> <br><br>In message <<a href="mailto:20100607001427.7E7161CC37@ptavv.es.net">20100607001427.7E7161CC37@ptavv.es.net</a>>, "Kevin Oberman" writes:<br>> > I am using <a href="http://godaddy.com/" target="_blank">godaddy.com</a> for my .org domains and as per the customer support<br> > > replies, they donot support DNSSEC and thus cannot add DS records for my<br>> > domains.<br>> ><br>> > Which other registrars people are using that allow DS records.<br>> ><br>> > Thanks<br> > > -dani<br>><br>> Last I checked, .org, while signed, was not yet accepting DS records from<br>> anyone. I suspect that no gtld other than .gov will accept them until the roo<br>> t<br>> is signed next month.<br> <br>PIR announced 90 days from the 15th of March, that is this month, before<br>the root is signed. That 90 days expires next Sunday.<br><br>".ORG will enable second level signing in June 2010, the root will<br>follow shortly after, and in early 2011 .COM and .NET will also be<br> signed."<br><br> <a href="http://www.pir.org/blog/2010/90daydnssec" target="_blank">http://www.pir.org/blog/2010/90daydnssec</a><br><br>> I do know that afilias was certifying registrars and I believe that they will<br> ><br>> be releasing a list of those registrars that are certified, but that will not<br>><br>> mean that they will be accepting them immediately.<br>><br>> Until then, <a href="http://dlv.isc.org/" target="_blank">dlv.isc.org</a> is the best (only?) option.<br> > --<br>> R. Kevin Oberman, Network Engineer<br>> Energy Sciences Network (ESnet)<br>> Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab)<br>> E-mail: <a href="mailto:oberman@es.net">oberman@es.net</a> Phone: +1 510 486-8634<br> > Key fingerprint:059B 2DDF 031C 9BA3 14A4 EADA 927D EBB3 987B 3751<br>><br>><br>> _______________________________________________<br>> bind-users mailing list<br>> <a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br> > <a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>--<br>Mark Andrews, ISC<br>1 Seymour St., Dundas Valley, NSW 2117, Australia<br>PHONE: +61 2 9871 4742 INTERNET: <a href="mailto:marka@isc.org">marka@isc.org</a><br> <br><br>------------------------------<br><br>Message: 5<br>Date: Sun, 6 Jun 2010 19:33:21 -0700<br>From: itservices88 <<a href="mailto:itservices88@gmail.com">itservices88@gmail.com</a>><br>Subject: Re: .org registrars allowing DS records<br> To: Mark Andrews <<a href="mailto:marka@isc.org">marka@isc.org</a>><br>Cc: <a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br>Message-ID:<br> <<a href="mailto:AANLkTikJq8jdHcRVRPEy1DEqB0Gk4LwugPOZX1uHuBHH@mail.gmail.com">AANLkTikJq8jdHcRVRPEy1DEqB0Gk4LwugPOZX1uHuBHH@mail.gmail.com</a>><br> Content-Type: text/plain; charset="iso-8859-1"<br><br>Thanks All.<br><br>-dani<br><br>On Sun, Jun 6, 2010 at 6:47 PM, Mark Andrews <<a href="mailto:marka@isc.org">marka@isc.org</a>> wrote:<br><br>><br>> In message <<a href="mailto:20100607001427.7E7161CC37@ptavv.es.net">20100607001427.7E7161CC37@ptavv.es.net</a>>, "Kevin Oberman"<br> > writes:<br>> > > I am using <a href="http://godaddy.com/" target="_blank">godaddy.com</a> for my .org domains and as per the customer<br>> support<br>> > > replies, they donot support DNSSEC and thus cannot add DS records for<br> > my<br>> > > domains.<br>> > ><br>> > > Which other registrars people are using that allow DS records.<br>> > ><br>> > > Thanks<br>> > > -dani<br>> ><br>> > Last I checked, .org, while signed, was not yet accepting DS records from<br> > > anyone. I suspect that no gtld other than .gov will accept them until the<br>> roo<br>> > t<br>> > is signed next month.<br>><br>> PIR announced 90 days from the 15th of March, that is this month, before<br> > the root is signed. That 90 days expires next Sunday.<br>><br>> ".ORG will enable second level signing in June 2010, the root will<br>> follow shortly after, and in early 2011 .COM and .NET will also be<br> > signed."<br>><br>> <a href="http://www.pir.org/blog/2010/90daydnssec" target="_blank">http://www.pir.org/blog/2010/90daydnssec</a><br>><br>> > I do know that afilias was certifying registrars and I believe that they<br> > will<br>> ><br>> > be releasing a list of those registrars that are certified, but that will<br>> not<br>> ><br>> > mean that they will be accepting them immediately.<br>> ><br>> > Until then, <a href="http://dlv.isc.org/" target="_blank">dlv.isc.org</a> is the best (only?) option.<br> > > --<br>> > R. Kevin Oberman, Network Engineer<br>> > Energy Sciences Network (ESnet)<br>> > Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab)<br>> > E-mail: <a href="mailto:oberman@es.net">oberman@es.net</a> Phone: +1 510 486-8634<br> > > Key fingerprint:059B 2DDF 031C 9BA3 14A4 EADA 927D EBB3 987B 3751<br>> ><br>> ><br>> > _______________________________________________<br>> > bind-users mailing list<br>> > <a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br> > > <a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>> --<br>> Mark Andrews, ISC<br>> 1 Seymour St., Dundas Valley, NSW 2117, Australia<br> > PHONE: +61 2 9871 4742 INTERNET: <a href="mailto:marka@isc.org">marka@isc.org</a><br>><br>-------------- next part --------------<br>An HTML attachment was scrubbed...<br>URL: <<a href="https://lists.isc.org/pipermail/bind-users/attachments/20100606/9c584c1f/attachment-0001.html" target="_blank">https://lists.isc.org/pipermail/bind-users/attachments/20100606/9c584c1f/attachment-0001.html</a>><br> <br>------------------------------<br><br>Message: 6<br>Date: Mon, 7 Jun 2010 08:58:20 +0530<br>From: rams <<a href="mailto:bramesh80@gmail.com">bramesh80@gmail.com</a>><br>Subject: how to resign a zone<br>To: bind-users <<a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a>><br> Message-ID:<br> <<a href="mailto:AANLkTik-IXXoivRrSgM3lhiVndPA3sC4rVd5x9id1-Hl@mail.gmail.com">AANLkTik-IXXoivRrSgM3lhiVndPA3sC4rVd5x9id1-Hl@mail.gmail.com</a>><br>Content-Type: text/plain; charset="iso-8859-1"<br> <br>Hi,<br><br>How to resign a zone?<br><br>Thanks & Regards,<br>Ramesh<br>-------------- next part --------------<br>An HTML attachment was scrubbed...<br>URL: <<a href="https://lists.isc.org/pipermail/bind-users/attachments/20100607/f57f3819/attachment-0001.html" target="_blank">https://lists.isc.org/pipermail/bind-users/attachments/20100607/f57f3819/attachment-0001.html</a>><br> <br>------------------------------<br><br>Message: 7<br>Date: Mon, 07 Jun 2010 06:41:31 -0400<br>From: Alan Clegg <<a href="mailto:aclegg@isc.org">aclegg@isc.org</a>><br>Subject: Re: how to resign a zone<br>To: <a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br> Message-ID: <<a href="mailto:4C0CCCDB.3050201@isc.org">4C0CCCDB.3050201@isc.org</a>><br>Content-Type: text/plain; charset="iso-8859-1"<br><br>On 6/6/2010 11:28 PM, rams wrote:<br>> Hi,<br>><br>> How to resign a zone?<br> <br>Make it dynamic, allow BIND to have access to the keys and you don't<br>have to do anything "manually".<br><br>If you don't have (or want to use) that option, you need to run<br>"dnssec-signzone" on the signed data (to refresh existing signatures) or<br> on the original input file (if you want to generate all new signatures).<br><br>AlanC<br><br>-------------- next part --------------<br>A non-text attachment was scrubbed...<br>Name: signature.asc<br>Type: application/pgp-signature<br> Size: 260 bytes<br>Desc: OpenPGP digital signature<br>URL: <<a href="https://lists.isc.org/pipermail/bind-users/attachments/20100607/e1bb8056/attachment-0001.bin" target="_blank">https://lists.isc.org/pipermail/bind-users/attachments/20100607/e1bb8056/attachment-0001.bin</a>><br> <br>------------------------------<br><br>_______________________________________________<br>bind-users mailing list<br><a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br><a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br> <br>End of bind-users Digest, Vol 538, Issue 1<br>******************************************<br></blockquote></div><br> _______________________________________________<br>bind-users mailing list<br><a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br><a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a></blockquote></div><br><div> <span class="Apple-style-span" style="font-size: 12px; "><div style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; "><div>--</div><div>"When it comes to glittering objects, wizards have all the taste and self-control of a deranged magpie."</div><div>-- Terry Pratchett</div><div><br class="khtml-block-placeholder"></div><div><br class="khtml-block-placeholder"></div></div><br class="Apple-interchange-newline"></span> </div><br></body></html>