<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">When I perform a ZSK key rollover the existing ZSK disappears
<b>immediately</b> so not sure what I am missing when using the KASP to manage key rollover. The state for the keys looks good and for this test I have TTL set to 1 hour.. But why does dig not show me both DNSKEY records for the ZSK after I initiate the rollover
when there should be overlap as described in <a href="https://kb.isc.org/docs/aa-00822" id="LPNoLPOWALinkPreview" class="OWAAutoLink ContentPasted11">Automatic DNSSEC Zone Signing Key rollover explained (isc.org)</a>?</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Bind 9.16.23 which seems to be the newest release provided by my distribution. I reviewed the ARM for notes for newer releases in the 9.16 branch and did
not see mention of any rollover bugs or for dig.</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<ol data-editing-info="{"orderedStyleType":1,"unorderedStyleType":1}" data-listchain="__List_Chain_1320">
<li style="list-style-type: "1. "; margin: 0in 0in 0in -0.25in;"><span> Here is the key info from dig for ZSK key 15465 at 17:17.</span>
<div style="list-style-type: "2. "; margin: 0in 0in 0in -0.25in;"><span><br>
</span></div>
<div style="list-style-type: "2. "; margin: 0in 0in 0in -0.25in;"><span class="ContentPasted1"># dig @localhost myexample.com DNSKEY +multi
<div><br class="ContentPasted1">
</div>
<div class="ContentPasted1">; <<>> DiG 9.16.23-RH <<>> @localhost myexample.com DNSKEY +multi</div>
<div class="ContentPasted1">; (2 servers found)</div>
<div class="ContentPasted1">;; global options: +cmd</div>
<div class="ContentPasted1">;; Got answer:</div>
<div class="ContentPasted1">;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41895</div>
<div class="ContentPasted1">;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1</div>
<div><br class="ContentPasted1">
</div>
<div class="ContentPasted1">;; OPT PSEUDOSECTION:</div>
<div class="ContentPasted1">; EDNS: version: 0, flags:; udp: 1232</div>
<div class="ContentPasted1">; COOKIE: 7c2a0e61926d2d3a010000006515fb68eef12b631ca40c20 (good)</div>
<div class="ContentPasted1">;; QUESTION SECTION:</div>
<div class="ContentPasted1">;myexample.com. IN DNSKEY</div>
<div><br class="ContentPasted1">
</div>
<div class="ContentPasted1">;; ANSWER SECTION:</div>
<div class="ContentPasted1">myexample.com. 3600 IN DNSKEY 257 3 13 (</div>
<div class="ContentPasted1"> 20agIXl9sQCo00yiHHviYWZG8TvVmDoVxPJwO3mlcwxB</div>
<div class="ContentPasted1"> le7UNrzNQaeukC6teT4XrqYflqDxcM6d9L/mtREIKA==</div>
<div class="ContentPasted1"> ) ; KSK; alg = ECDSAP256SHA256 ; key id = 31296</div>
<div class="ContentPasted1">myexample.com. 3600 IN DNSKEY 256 3 13 (</div>
<div class="ContentPasted1"> AlKXH5aebvboC4laAovc6wfg6uGK1uTbTqYYnhKadSq6</div>
<div class="ContentPasted1"> 78nSI3DyM+1t91jqQ81tlBy+e3hJyKtlX/OiOhuZcA==</div>
) ; ZSK; alg = ECDSAP256SHA256 ; key id = 15465<br>
</span></div>
</li></ol>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0 ContentPasted2">
;; Query time: 3 msec
<div class="ContentPasted2">;; SERVER: 127.0.0.1#53(127.0.0.1)</div>
<div class="ContentPasted2">;; WHEN: Thu Sep 28 17:17:12 CDT 2023</div>
<div class="ContentPasted2">;; MSG SIZE rcvd: 230</div>
<br>
</div>
<ol start="3" data-editing-info="{"orderedStyleType":1,"unorderedStyleType":1}" data-listchain="__List_Chain_1321">
<li style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; list-style-type: "3. "; margin: 0in 0in 0in -0.25in; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0 ContentPasted2">
Here is the info from the key as far as state goes.
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; list-style-type: "4. "; margin: 0in 0in 0in -0.25in; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0 ContentPasted2">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; list-style-type: "4. "; margin: 0in 0in 0in -0.25in; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0 ContentPasted2 ContentPasted3">
# more Kmyexample.com.+013+15465.key
<div class="ContentPasted3">; This is a zone-signing key, keyid 15465, for myexample.com.</div>
<div class="ContentPasted3">; Created: 20230928221438 (Thu Sep 28 17:14:38 2023)</div>
<div class="ContentPasted3">; Publish: 20230928221438 (Thu Sep 28 17:14:38 2023)</div>
<div class="ContentPasted3">; Activate: 20230928221438 (Thu Sep 28 17:14:38 2023)</div>
<div class="ContentPasted3">; Inactive: 20231127221438 (Mon Nov 27 16:14:38 2023)</div>
<div class="ContentPasted3">; Delete: 20231207231938 (Thu Dec 7 17:19:38 2023)</div>
<div class="ContentPasted3">myexample.com. 3600 IN DNSKEY 256 3 13 AlKXH5aebvboC4laAovc6wfg6uGK1uTbTqYYnhKadSq678nSI3DyM+1t 91jqQ81tlBy+e3hJyKtlX/OiOhuZcA==</div>
<div><br class="ContentPasted3">
</div>
<div class="ContentPasted3"># more Kmyexample.com.+013+15465.state</div>
<div class="ContentPasted3">; This is the state of key 15465, for myexample.com.</div>
<div class="ContentPasted3">Algorithm: 13</div>
<div class="ContentPasted3">Length: 256</div>
<div class="ContentPasted3">Lifetime: 5184000</div>
<div class="ContentPasted3">KSK: no</div>
<div class="ContentPasted3">ZSK: yes</div>
<div class="ContentPasted3">Generated: 20230928221438 (Thu Sep 28 17:14:38 2023)</div>
<div class="ContentPasted3">Published: 20230928221438 (Thu Sep 28 17:14:38 2023)</div>
<div class="ContentPasted3">Active: 20230928221438 (Thu Sep 28 17:14:38 2023)</div>
<div class="ContentPasted3">Retired: 20231127221438 (Mon Nov 27 16:14:38 2023)</div>
<div class="ContentPasted3">Removed: 20231207231938 (Thu Dec 7 17:19:38 2023)</div>
<div class="ContentPasted3">DNSKEYChange: 20230928221438 (Thu Sep 28 17:14:38 2023)</div>
<div class="ContentPasted3">ZRRSIGChange: 20230928221438 (Thu Sep 28 17:14:38 2023)</div>
<div class="ContentPasted3">DNSKEYState: rumoured</div>
<div class="ContentPasted3">ZRRSIGState: rumoured</div>
GoalState: omnipresent<br>
</div>
</li></ol>
<ol start="4" data-editing-info="{"orderedStyleType":1,"unorderedStyleType":1}" data-listchain="__List_Chain_1321">
<li style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; list-style-type: "4. "; margin: 0in 0in 0in -0.25in; color: rgb(0, 0, 0);" class="elementToProof">
Ran rollover at 17:22.</li></ol>
<div class="elementToProof"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"># rndc dnssec -rollover -key 15465 myexample.com</span><br class="ContentPasted4" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
</div>
<div><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Key 15465: Rollover scheduled on 28-Sep-2023 17:22:35.000</span><br style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted5">
5. Ran dig at 17:22 and it now just shows the new ZSK <span style="display: inline !important; background-color: rgb(255, 255, 255);" class="ContentPasted6">3913! Where did the prior ZSK go (15465)?</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted5">
<span style="display: inline !important; background-color: rgb(255, 255, 255);" class="ContentPasted6"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted5">
# dig @localhost myexample.com DNSKEY +multi
<div><br class="ContentPasted5">
</div>
<div class="ContentPasted5">; <<>> DiG 9.16.23-RH <<>> @localhost myexample.com DNSKEY +multi</div>
<div class="ContentPasted5">; (2 servers found)</div>
<div class="ContentPasted5">;; global options: +cmd</div>
<div class="ContentPasted5">;; Got answer:</div>
<div class="ContentPasted5">;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21486</div>
<div class="ContentPasted5">;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1</div>
<div><br class="ContentPasted5">
</div>
<div class="ContentPasted5">;; OPT PSEUDOSECTION:</div>
<div class="ContentPasted5">; EDNS: version: 0, flags:; udp: 1232</div>
<div class="ContentPasted5">; COOKIE: 419494d5cbae21fd010000006515fcb383972461377bf329 (good)</div>
<div class="ContentPasted5">;; QUESTION SECTION:</div>
<div class="ContentPasted5">;myexample.com. IN DNSKEY</div>
<div><br class="ContentPasted5">
</div>
<div class="ContentPasted5">;; ANSWER SECTION:</div>
<div class="ContentPasted5">myexample.com. 3600 IN DNSKEY 257 3 13 (</div>
<div class="ContentPasted5"> 20agIXl9sQCo00yiHHviYWZG8TvVmDoVxPJwO3mlcwxB</div>
<div class="ContentPasted5"> le7UNrzNQaeukC6teT4XrqYflqDxcM6d9L/mtREIKA==</div>
<div class="ContentPasted5"> ) ; KSK; alg = ECDSAP256SHA256 ; key id = 31296</div>
<div class="ContentPasted5">myexample.com. 3600 IN DNSKEY 256 3 13 (</div>
<div class="ContentPasted5"> FdOW/okezOBOscx4/E4UfaSBkgK9tsnUZ8dvV5AZKMeH</div>
<div class="ContentPasted5"> jdH/jtYfASaeyrVYfclPsFuW5dLO7CU86vIplYKpEg==</div>
<div class="ContentPasted5"> ) ; ZSK; alg = ECDSAP256SHA256 ; key id = 3913</div>
<div><br class="ContentPasted5">
</div>
<div class="ContentPasted5">;; Query time: 4 msec</div>
<div class="ContentPasted5">;; SERVER: 127.0.0.1#53(127.0.0.1)</div>
<div class="ContentPasted5">;; WHEN: Thu Sep 28 17:22:43 CDT 2023</div>
;; MSG SIZE rcvd: 230<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted5">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted5">
6. The key state for the original ZSK (15465) has been updated and looks like it is set to become inactive at 19:27 which is what I expect based on my TTL of 60 minutes. The new key (03913) shows that it will be active at 19:27 which looks correct.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted5">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted5 ContentPasted7">
# more Kmyexample.com.+013+15465.key
<div class="ContentPasted7">; This is a zone-signing key, keyid 15465, for myexample.com.</div>
<div class="ContentPasted7">; Created: 20230928221438 (Thu Sep 28 17:14:38 2023)</div>
<div class="ContentPasted7">; Publish: 20230928221438 (Thu Sep 28 17:14:38 2023)</div>
<div class="ContentPasted7">; Activate: 20230928221438 (Thu Sep 28 17:14:38 2023)</div>
<div class="ContentPasted7">; Inactive: 20230929002735 (Thu Sep 28 19:27:35 2023)</div>
<div class="ContentPasted7">; Delete: 20231009013235 (Sun Oct 8 20:32:35 2023)</div>
<div class="ContentPasted7">myexample.com. 3600 IN DNSKEY 256 3 13 AlKXH5aebvboC4laAovc6wfg6uGK1uTbTqYYnhKadSq678nSI3DyM+1t 91jqQ81tlBy+e3hJyKtlX/OiOhuZcA==</div>
<div class="ContentPasted7"><br>
</div>
<div class="ContentPasted7"># more Kmyexample.com.+013+15465.state</div>
<div class="ContentPasted7">; This is the state of key 15465, for myexample.com.</div>
<div class="ContentPasted7">Algorithm: 13</div>
<div class="ContentPasted7">Length: 256</div>
<div class="ContentPasted7">Lifetime: 7977</div>
<div class="ContentPasted7">Successor: 3913</div>
<div class="ContentPasted7">KSK: no</div>
<div class="ContentPasted7">ZSK: yes</div>
<div class="ContentPasted7">Generated: 20230928221438 (Thu Sep 28 17:14:38 2023)</div>
<div class="ContentPasted7">Published: 20230928221438 (Thu Sep 28 17:14:38 2023)</div>
<div class="ContentPasted7">Active: 20230928221438 (Thu Sep 28 17:14:38 2023)</div>
<div class="ContentPasted7">Retired: 20230929002735 (Thu Sep 28 19:27:35 2023)</div>
<div class="ContentPasted7">Removed: 20231009013235 (Sun Oct 8 20:32:35 2023)</div>
<div class="ContentPasted7">DNSKEYChange: 20230928222235 (Thu Sep 28 17:22:35 2023)</div>
<div class="ContentPasted7">ZRRSIGChange: 20230928222235 (Thu Sep 28 17:22:35 2023)</div>
<div class="ContentPasted7">DNSKEYState: unretentive</div>
<div class="ContentPasted7">ZRRSIGState: unretentive</div>
GoalState: hidden<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted5 ContentPasted7">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted5 ContentPasted7 ContentPasted9">
# more Kmyexample.com.+013+03913.key
<div class="ContentPasted9">; This is a zone-signing key, keyid 3913, for myexample.com.</div>
<div class="ContentPasted9">; Created: 20230928222235 (Thu Sep 28 17:22:35 2023)</div>
<div class="ContentPasted9">; Publish: 20230928222235 (Thu Sep 28 17:22:35 2023)</div>
<div class="ContentPasted9">; Activate: 20230929002735 (Thu Sep 28 19:27:35 2023)</div>
<div class="ContentPasted9">; Inactive: 20231128002735 (Mon Nov 27 18:27:35 2023)</div>
<div class="ContentPasted9">; Delete: 20231208013235 (Thu Dec 7 19:32:35 2023)</div>
<div class="ContentPasted9">myexample.com. 3600 IN DNSKEY 256 3 13 FdOW/okezOBOscx4/E4UfaSBkgK9tsnUZ8dvV5AZKMeHjdH/jtYfASae yrVYfclPsFuW5dLO7CU86vIplYKpEg==</div>
<div class="ContentPasted9"><br>
</div>
<div class="ContentPasted9"># more Kmyexample.com.+013+03913.state</div>
<div class="ContentPasted9">; This is the state of key 3913, for myexample.com.</div>
<div class="ContentPasted9">Algorithm: 13</div>
<div class="ContentPasted9">Length: 256</div>
<div class="ContentPasted9">Lifetime: 5184000</div>
<div class="ContentPasted9">Predecessor: 15465</div>
<div class="ContentPasted9">KSK: no</div>
<div class="ContentPasted9">ZSK: yes</div>
<div class="ContentPasted9">Generated: 20230928222235 (Thu Sep 28 17:22:35 2023)</div>
<div class="ContentPasted9">Published: 20230928222235 (Thu Sep 28 17:22:35 2023)</div>
<div class="ContentPasted9">Active: 20230929002735 (Thu Sep 28 19:27:35 2023)</div>
<div class="ContentPasted9">Retired: 20231128002735 (Mon Nov 27 18:27:35 2023)</div>
<div class="ContentPasted9">Removed: 20231208013235 (Thu Dec 7 19:32:35 2023)</div>
<div class="ContentPasted9">DNSKEYChange: 20230928222235 (Thu Sep 28 17:22:35 2023)</div>
<div class="ContentPasted9">ZRRSIGChange: 20230928222235 (Thu Sep 28 17:22:35 2023)</div>
<div class="ContentPasted9">DNSKEYState: rumoured</div>
<div class="ContentPasted9">ZRRSIGState: rumoured</div>
<div class="ContentPasted9">GoalState: omnipresent</div>
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted5 ContentPasted7">
My policy:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted5 ContentPasted7 ContentPasted8">
dnssec-policy "my-default" {
<div class="ContentPasted8"> keys {</div>
<div class="ContentPasted8"> zsk key-directory lifetime P60D algorithm ecdsap256sha256;</div>
<div class="ContentPasted8"> ksk key-directory lifetime unlimited algorithm ecdsap256sha256;</div>
<div class="ContentPasted8"> };</div>
<div><br class="ContentPasted8">
</div>
<div class="ContentPasted8"> // Key timings</div>
<div class="ContentPasted8"> dnskey-ttl PT1H;</div>
<div class="ContentPasted8"> publish-safety PT1H;</div>
<div class="ContentPasted8"> purge-keys P90D;</div>
<div class="ContentPasted8"> retire-safety PT1H;</div>
<div><br class="ContentPasted8">
</div>
<div class="ContentPasted8"> // Signature timings</div>
<div class="ContentPasted8"> signatures-refresh P5D;</div>
<div class="ContentPasted8"> signatures-validity P14D;</div>
<div class="ContentPasted8"> signatures-validity-dnskey P14D;</div>
<div><br class="ContentPasted8">
</div>
<div class="ContentPasted8"> // Zone parameters</div>
<div class="ContentPasted8"> max-zone-ttl P1D;</div>
<div class="ContentPasted8"> parent-ds-ttl P1D;</div>
<div class="ContentPasted8"> parent-propagation-delay PT1H;</div>
<div class="ContentPasted8"> zone-propagation-delay PT5M;</div>
<div class="ContentPasted8">};</div>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted5 ContentPasted7 ContentPasted8">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted5 ContentPasted7 ContentPasted8">
Zone file:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted5 ContentPasted7 ContentPasted8 ContentPasted10">
# cat /var/named/myexample.com.db
<div class="ContentPasted10"><br>
</div>
<div class="ContentPasted10">$ORIGIN myexample.com.</div>
<div class="ContentPasted10">$TTL 60m</div>
<div><br class="ContentPasted10">
</div>
<div class="ContentPasted10"><span style="">@ IN SOA ns01.myexample.com. postmaster.myexample.com. (</span><br>
</div>
<div class="ContentPasted10"> 15 ; Serial</div>
<div class="ContentPasted10"> 3h ; Refresh after 3 hours</div>
<div class="ContentPasted10"> 1h ; Retry after 1 hour</div>
<div class="ContentPasted10"> 1w ; Expire after 1 week</div>
<div class="ContentPasted10"> 1h ) ; Negative caching TTL of 1 hour</div>
<div><br>
</div>
<div class="ContentPasted10">@ IN NS ns01.myexample.com.</div>
<div><br class="ContentPasted10">
</div>
<div class="ContentPasted10"><br>
</div>
<div><br class="ContentPasted10">
</div>
<div class="ContentPasted10">ns01 IN A 10.1.2.3</div>
<br>
</div>
</body>
</html>