<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Thanks for the reply....<br>
</p>
<div class="moz-cite-prefix">On 2020/04/14 08:42, Matthijs Mekking
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:ecabcc31-7ee9-1227-5b8e-9f498c7de9e9@isc.org">
<pre class="moz-quote-pre" wrap="">Mark,
On 4/13/20 8:54 PM, Evan Hunt wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">On Mon, Apr 13, 2020 at 02:22:53PM +0200, Mark Elkins wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Question - What are the "TYPE65534" records? What are they saying? I am
using "DiG 9.16.1" so surprised it doesn't know.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
This is a mechanism named uses to keep track of the status of zone
signing operations, so that if there's a crash or power outage before
signing is complete, it'll know which step it needs to resume on. To
see the status in a human-readable form, use "rndc signing -list <zone>".
If it says signing is complete, you're free to remove the records
with "rndc signing -clear all <zone>".
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">My zones '$TTL' is 1200... so I would have thought the CDS record would
have appeared by now.
I "signed" the zone at Apr 12 21:27 +02:00 and its now 16 hours later. I
thought the biggest delay factor is the zones $TTL, often set to one day.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
I'm... not sure CDS is published automaitcally yet. I'd have to check to be
sure, but I think that's coming in a future release.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
If you sign your zone for the first time, named needs to make sure the
DNSKEY and RRSIG records are long enough in the zone such that if a
resolver is able to fetch the DS, it must also be able to fetch the
corresponding DNSKEY and RRSIG records. Only then the CDS is published
indicating it is safe to submit the DS record.
This time is the the maximum zone TTL, zone propagation delay, and
publish safety time. The dnssec-policy does not yet look into the zone
for the maximum TTL but derives it from configuration. The default
policy sets the maximum zone TTL to 1 day. Together with the zone
propagation delay and publish safety delay from the default policy this
is a 25 hour and 5 minute wait before the CDS is published.
Obviously you can change your policy to lower the maximum-zone-ttl to
1200 in your case (and if you don't care about a publish safety period,
you can set it to 0 seconds).</pre>
</blockquote>
<p><br>
</p>
<p>Got that. So if one has a rarely changing zone and gives it a
(default) $TTL of four days - then the defaults in the
"dnssec-policy" will be<br>
too short! Something for people to think about. I think the
dnssec-policy system should probably look into the Zone as the
default method<br>
of finding the "maximum zone TTL".<br>
</p>
<pre class="moz-quote-pre" wrap="">
</pre>
<blockquote type="cite"
cite="mid:ecabcc31-7ee9-1227-5b8e-9f498c7de9e9@isc.org">
<blockquote type="cite">
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Looks like the SOA Serial Number still needs to be maintained manually.
Was expecting a more OpenDNSSEC approach. Would love an automated
YYYYMMDDxx number - date it was last 'modified'. Would be perfect for
small zones that are rarely updated.
</pre>
</blockquote>
</blockquote>
<pre class="moz-quote-pre" wrap="">
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">I think the zone option "serial-update-method date;" does this. (I haven't
tested it with dnssec-policy though.)
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Despite the documentation says this is for dynamic DNS zones, this also
works for inline-signing and dnssec-policy zones.
</pre>
</blockquote>
<p>Thumbs Up!</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:ecabcc31-7ee9-1227-5b8e-9f498c7de9e9@isc.org">
<pre class="moz-quote-pre" wrap="">
- Matthijs
</pre>
</blockquote>
<div class="moz-signature">-- <br>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<title></title>
<p>Mark James ELKINS - Posix Systems - (South) Africa<br>
<a class="moz-txt-link-abbreviated" href="mailto:mje@posix.co.za">mje@posix.co.za</a> Tel: <a href="tel:+27826010496">+27.826010496</a><br>
For fast, reliable, low cost Internet in ZA: <a
href="https://ftth.posix.co.za">https://ftth.posix.co.za</a><br>
<br>
<img moz-do-not-send="false"
src="cid:part3.C287F0E2.8604B8D1@posix.co.za" alt="Posix
Systems" width="250" height="165"><img moz-do-not-send="false"
src="cid:part4.524C4B64.2A9D08B2@posix.co.za" alt="VCARD for
MJ Elkins" title="VCARD, Scan me please!" width="164"
height="164"><br>
</p>
</div>
</body>
</html>