<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><br></div><div>On 20 Sep 2017, at 15:32, rams <<a href="mailto:bramesh80@gmail.com">bramesh80@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div dir="ltr"><div>We are getting two RRSIGs and 3 DNSKEY [ 1-256 and 2-257] when we do KSK rollover. Is it correct we are returning two RRSIGs for DNSKEY? </div></div></blockquote><br><div>Yes :-)</div><div><br></div><div>There are multiple ways to do a KSK rollover: you are doing a double-KSK rollover. The full explanation is in RFC 7583 which I strongly recommend you read (it is not too scary) - the tools are still not robust enough to save you from mistakes.</div><div><br></div><div><a href="https://tools.ietf.org/html/rfc7583#section-2.2">https://tools.ietf.org/html/rfc7583#section-2.2</a></div><div><br></div><div><div id="AppleMailSignature"><span style="background-color: rgba(255, 255, 255, 0);">Tony.</span><div><span style="background-color: rgba(255, 255, 255, 0);">-- </span></div><div><span style="background-color: rgba(255, 255, 255, 0);">f.anthony.n.finch <<a href="mailto:dot@dotat.at">dot@dotat.at</a>> <a href="http://dotat.at">http://dotat.at</a></span></div><div><br></div></div></div></body></html>