<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Found it.... my problem.</p>
<p>I used to create the CDS records using a binary that has now been
withdrawn by ISC (around November/December 2021) and now use...<br>
<br>
dnssec-dsfromkey -C $key</p>
<p>...except I was running that on all keys - including ZSK's...</p>
<p>I have a bash shell script that does the signing. First written
in 2011.<br>
Yes - I am testing with "dnssec-policy"...</p>
<p>-----------------------------------</p>
<p>dnssec-policy "posix-ecdsa256-policy" {<br>
dnskey-ttl 3600;<br>
keys {<br>
ksk lifetime unlimited algorithm ecdsa256;<br>
zsk lifetime 34d algorithm ecdsa256;<br>
};<br>
};<br>
<br>
zone "smtp.co.za" {<br>
type master;<br>
file "/etc/ns.d/pri/smtp.co.za/db.smtp.co.za";<br>
key-directory "/etc/ns.d/pri/smtp.co.za/keys";<br>
dnssec-policy "posix-ecdsa256-policy";<br>
serial-update-method date;<br>
};<br>
-----------------------------------</p>
<p>... but until there is a trigger system so I can call code to do
an EPP based KSK rollover to the parent, will keep what I've got
as it (usually) works.<br>
</p>
<div class="moz-cite-prefix">On 1/25/22 12:58 AM, Mark Andrews
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:D731B6E5-9137-4D47-AEF4-63C0B5E5919D@isc.org">
<pre class="moz-quote-pre" wrap="">
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">On 25 Jan 2022, at 07:35, Mark Elkins <a class="moz-txt-link-rfc2396E" href="mailto:mje@posix.co.za"><mje@posix.co.za></a> wrote:
I've just noticed that in the last few days that "BIND 9.16.22 (Extended Support Version) <id:59bfaba>" appears to be generating CDS records for both KSK ***and ZSK*** records!
Nothing on my side has been changed although I do run automated updates. I'm on a Linux machine running Gentoo.
$ dig DNSKEY EDU.ZA
; <<>> DiG 9.16.6 <<>> DNSKEY EDU.ZA
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22867
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;EDU.ZA. IN DNSKEY
;; ANSWER SECTION:
EDU.ZA. 9378 IN DNSKEY 256 3 13 U9/K052f1oBX5WYbedZhLM0jd+rNAwEYNfuRUAsf2S3U7UNaEKV2pYtM 3dHSOdsNDiLkr0H77x9U2ZFtoN7U2A==
EDU.ZA. 9378 IN DNSKEY 256 3 13 YPgTWLFxFXWMXlVaJB2bCA5F75l5yryFO/h9w+xXS/GfhhmvyZvh9NCv MLPZckLRGbeZ5/BkyH9ae4X0IyzKYA==
EDU.ZA. 9378 IN DNSKEY 257 3 13 75OMA5R90131FVGX1QcJiCGAUboYSmazf3dPpAPL0t33YLcx7bBnio6Y qyrR77MRVZKNpWIBLcnz7YOLWNZXmQ==
---------------------------
$ dig CDS EDU.ZA
; <<>> DiG 9.16.6 <<>> CDS EDU.ZA
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11376
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;EDU.ZA. IN CDS
;; ANSWER SECTION:
EDU.ZA. 86400 IN CDS 569 13 2 350F4414CB611C04AD829CD2C23A5C60296EA635BF59D7F0B44CD02F 6B396A94
EDU.ZA. 86400 IN CDS 9355 13 2 B0A16FBB3F5D6274665DE272FE5FF182ABC89B3072B668589E5EC6F0 513E36C9
EDU.ZA. 86400 IN CDS 49988 13 2 6F99A6D6A4657F0A528AD2791B8B3E02AFB34E5DB79F5C53EA022A55 1874D40A
These are also the values from inside my signed zone. Anyone have any thoughts?
This is going to screw up systems that poll for CDS records.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Well CDS records are for DNSKEYs without the SEP bit are perfectly valid as the SEP bit is purely advisory and
no it should screw up systems that poll for CDS records. You will however have to manage them properly in the
future.
You haven’t said how you are managing DNSSEC and named supports several models so it is hard to a) tell if
there was a bug in our code or b) an error on your part.
Assuming that you are not using dnssec-policy you should be able to use 'dnssec-settime -D sync date/offset’
on the ZSK’s to tell named to stop publishing the CDS records but remember you still need to account for the
fact that they where published as you go forward.
Mark
</pre>
</blockquote>
<div class="moz-signature">-- <br>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<title></title>
<p>Mark James ELKINS - Posix Systems - (South) Africa<br>
<a class="moz-txt-link-abbreviated" href="mailto:mje@posix.co.za">mje@posix.co.za</a> Tel: <a href="tel:+27826010496">+27.826010496</a><br>
For fast, reliable, low cost Internet in ZA: <a
href="https://ftth.posix.co.za">https://ftth.posix.co.za</a><br>
<br>
<img moz-do-not-send="false"
src="cid:part3.5F14A0AD.0E9AB021@posix.co.za" alt="Posix
Systems" width="250" height="165"><img moz-do-not-send="false"
src="cid:part4.25E613C1.C56F98E6@posix.co.za" alt="VCARD for
MJ Elkins" title="VCARD, Scan me please!" width="164"
height="164"><br>
</p>
</div>
</body>
</html>