<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Anybody have any ideas on why my dnssec records don’t always automatically update on my NS2 authoritative server? On my NS1 authoritative server the records update without issue.<o:p></o:p></p>
<p class="MsoNormal">NS2 is an exact copy of NS1. We SCP all of the config files from the first server to the second server and do “rndc reconfig && rndc reload && systemctl restart bind” on both servers.<o:p></o:p></p>
<p class="MsoNormal">They are both Centos 7 running Bind 9.16.40.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">When it fails, I get this message:<o:p></o:p></p>
<p class="MsoNormal">[root@ns2 ~]# delv itctel.com @ns2.itctel.com<o:p></o:p></p>
<p class="MsoNormal">;; validating itctel.com/A: verify failed due to bad signature (keyid=3593): RRSIG has expired<o:p></o:p></p>
<p class="MsoNormal">;; validating itctel.com/A: no valid signature found<o:p></o:p></p>
<p class="MsoNormal">;; RRSIG has expired resolving 'itctel.com/A/IN': 75.102.160.231#53<o:p></o:p></p>
<p class="MsoNormal">;; validating itctel.com/A: verify failed due to bad signature (keyid=3593): RRSIG has expired<o:p></o:p></p>
<p class="MsoNormal">;; validating itctel.com/A: no valid signature found<o:p></o:p></p>
<p class="MsoNormal">;; RRSIG has expired resolving 'itctel.com/A/IN': 2607:d600:9000:300:75:102:160:231#53<o:p></o:p></p>
<p class="MsoNormal">;; resolution failed: RRSIG has expired<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I have this policy in named.conf<o:p></o:p></p>
<p class="MsoNormal">dnssec-policy "itc-no-rotate" {<o:p></o:p></p>
<p class="MsoNormal"> keys {<o:p></o:p></p>
<p class="MsoNormal"> ksk key-directory lifetime unlimited algorithm 13;<o:p></o:p></p>
<p class="MsoNormal"> zsk key-directory lifetime unlimited algorithm 13;<o:p></o:p></p>
<p class="MsoNormal"> };<o:p></o:p></p>
<p class="MsoNormal"> nsec3param;<o:p></o:p></p>
<p class="MsoNormal">};<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I have this set up in a custom includes file:<o:p></o:p></p>
<p class="MsoNormal">zone "itctel.com" in {<o:p></o:p></p>
<p class="MsoNormal"> type master;<o:p></o:p></p>
<p class="MsoNormal"> file "forward/itctel.com.zone";<o:p></o:p></p>
<p class="MsoNormal"> dnssec-policy itc-no-rotate;<o:p></o:p></p>
<p class="MsoNormal"> inline-signing yes;<o:p></o:p></p>
<p class="MsoNormal">};<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">No changes to my actual zone files. The inline signing takes care of everything.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Here is a list of my files for this domain<o:p></o:p></p>
<p class="MsoNormal">/var/named/forward/itctel.com.zone /var/named/forward/itctel.com.zone.jnl /var/named/forward/itctel.com.zone.signed<o:p></o:p></p>
<p class="MsoNormal">/var/named/forward/itctel.com.zone.jbk /var/named/forward/itctel.com.zone.new /var/named/forward/itctel.com.zone.signed.jnl<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p style="FONT-SIZE: 10pt; FONT-FAMILY: ARIAL"><strong style="FONT-FAMILY: Calibri"><span style="FONT-SIZE: 10pt; FONT-FAMILY: Calibri"><span style="FONT-FAMILY: Calibri">Michael Martinell</span></span></strong><br style="FONT-FAMILY: Calibri">
<span style="FONT-SIZE: 9pt; FONT-FAMILY: Calibri"><span style="FONT-FAMILY: Calibri">Network/Broadband Technician</span></span><br style="FONT-SIZE: 9pt; FONT-FAMILY: Calibri">
<br style="FONT-FAMILY: Calibri">
<strong style="FONT-FAMILY: Calibri">Interstate Telecommunications Coop., Inc.<br style="FONT-FAMILY: Calibri">
</strong><span style="FONT-SIZE: 8pt; FONT-FAMILY: Calibri">312 4th Street West • Clear Lake, SD 57226</span><br style="FONT-FAMILY: Calibri">
<span style="FONT-SIZE: 8pt; FONT-FAMILY: Calibri">Phone: (605) 874-8313</span><br style="FONT-FAMILY: Calibri">
<span style="FONT-SIZE: 8pt; FONT-FAMILY: Calibri">michael.martinell@itccoop.com</span><br style="FONT-FAMILY: Calibri">
<span style="FONT-SIZE: 8pt; FONT-FAMILY: Calibri">www.itc-web.com</span></p>
</body>
</html>