<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
Thank you for your kind reply - BIND is too smart for me! I can confirm that when you use a CSK key that letting BIND know that the key has been published ("rndc dnssec -keyid value -checkds published zone") resolves the issue with a CSK rollover which I tried
since I had issues with ZSKs doing the same thing.<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
The same solution does not seem to impact a ZSK rollover which baffles me. Are there any other considerations for when BIND might rollover a ZSK sooner than I expected?
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
I waited until ZSK was omnipresent and as soon as I run the rollover command the old key disappears (3 hour TTL) and my test zone is immediately resigned with the new ZSK. Rollover was about 30 minutes ago and current time is 18:40 on Oct 19...info shows that
the original ZSK should be still active but it is not.<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
<b>Original ZSK Key</b><br>
</div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)" class="elementToProof">
<p class="MsoNormal ContentPasted1" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
# cat *43876*.state<o:p class="ContentPasted1"> </o:p></p>
<p class="MsoNormal ContentPasted1" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
; This is the state of key 43876, for myexample2.com.<o:p class="ContentPasted1"> </o:p></p>
<p class="MsoNormal ContentPasted1" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
Algorithm: 13<o:p class="ContentPasted1"> </o:p></p>
<p class="MsoNormal ContentPasted1" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
Length: 256<o:p class="ContentPasted1"> </o:p></p>
<p class="MsoNormal ContentPasted1" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
Lifetime: 17702<o:p class="ContentPasted1"> </o:p></p>
<p class="MsoNormal ContentPasted1" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
Successor: 5264<o:p class="ContentPasted1"> </o:p></p>
<p class="MsoNormal ContentPasted1" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
KSK: no<o:p class="ContentPasted1"> </o:p></p>
<p class="MsoNormal ContentPasted1" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
ZSK: yes<o:p class="ContentPasted1"> </o:p></p>
<p class="MsoNormal ContentPasted1" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
Generated: 20231019202240 (Thu Oct 19 15:22:40 2023)<o:p class="ContentPasted1"> </o:p></p>
<p class="MsoNormal ContentPasted1" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
Published: 20231019202240 (Thu Oct 19 15:22:40 2023)<o:p class="ContentPasted1"> </o:p></p>
<p class="MsoNormal ContentPasted1" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
Active: 20231019202240 (Thu Oct 19 15:22:40 2023)<o:p class="ContentPasted1"> </o:p></p>
<p class="MsoNormal" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
<b><span style="background:yellow;mso-highlight:yellow" class="ContentPasted1">Retired: 20231020011742 (Thu Oct 19 20:17:42 2023)</span><o:p class="ContentPasted1"> </o:p></b></p>
<p class="MsoNormal ContentPasted1" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
Removed: 20231030022242 (Sun Oct 29 21:22:42 2023)<o:p class="ContentPasted1"> </o:p></p>
<p class="MsoNormal ContentPasted1" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
DNSKEYChange: 20231019231242 (Thu Oct 19 18:12:42 2023)<o:p class="ContentPasted1"> </o:p></p>
<p class="MsoNormal ContentPasted1" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
ZRRSIGChange: 20231019231242 (Thu Oct 19 18:12:42 2023)<o:p class="ContentPasted1"> </o:p></p>
<p class="MsoNormal ContentPasted1" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
DNSKEYState: unretentive<o:p class="ContentPasted1"> </o:p></p>
<p class="MsoNormal ContentPasted1" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
ZRRSIGState: unretentive<o:p class="ContentPasted1"> </o:p></p>
<p class="MsoNormal ContentPasted1" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
GoalState: hidden<o:p class="ContentPasted1"> <br>
</o:p></p>
<p class="MsoNormal ContentPasted1" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
<o:p class="ContentPasted1"><br>
</o:p></p>
<p class="MsoNormal ContentPasted1" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
<b><o:p class="ContentPasted1">New ZSK Key</o:p></b></p>
<p class="MsoNormal ContentPasted1" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
<o:p class="ContentPasted1"></o:p></p>
<p class="MsoNormal ContentPasted2" style="margin:0in 0in 8pt;font-size:11pt;margin-bottom:0in">
# cat *5264*.state<o:p class="ContentPasted2"> </o:p></p>
<p class="MsoNormal ContentPasted2" style="margin:0in 0in 8pt;font-size:11pt;margin-bottom:0in">
; This is the state of key 5264, for myexample2.com.<o:p class="ContentPasted2"> </o:p></p>
<p class="MsoNormal ContentPasted2" style="margin:0in 0in 8pt;font-size:11pt;margin-bottom:0in">
Algorithm: 13<o:p class="ContentPasted2"> </o:p></p>
<p class="MsoNormal ContentPasted2" style="margin:0in 0in 8pt;font-size:11pt;margin-bottom:0in">
Length: 256<o:p class="ContentPasted2"> </o:p></p>
<p class="MsoNormal ContentPasted2" style="margin:0in 0in 8pt;font-size:11pt;margin-bottom:0in">
Lifetime: 5184000<o:p class="ContentPasted2"> </o:p></p>
<p class="MsoNormal ContentPasted2" style="margin:0in 0in 8pt;font-size:11pt;margin-bottom:0in">
Predecessor: 43876<o:p class="ContentPasted2"> </o:p></p>
<p class="MsoNormal ContentPasted2" style="margin:0in 0in 8pt;font-size:11pt;margin-bottom:0in">
KSK: no<o:p class="ContentPasted2"> </o:p></p>
<p class="MsoNormal ContentPasted2" style="margin:0in 0in 8pt;font-size:11pt;margin-bottom:0in">
ZSK: yes<o:p class="ContentPasted2"> </o:p></p>
<p class="MsoNormal ContentPasted2" style="margin:0in 0in 8pt;font-size:11pt;margin-bottom:0in">
Generated: 20231019231242 (Thu Oct 19 18:12:42 2023)<o:p class="ContentPasted2"> </o:p></p>
<p class="MsoNormal ContentPasted2" style="margin:0in 0in 8pt;font-size:11pt;margin-bottom:0in">
Published: 20231019231242 (Thu Oct 19 18:12:42 2023)<o:p class="ContentPasted2"> </o:p></p>
<p class="MsoNormal" style="margin:0in 0in 8pt;font-size:11pt;margin-bottom:0in">
<b><span style="background:yellow;mso-highlight:yellow" class="ContentPasted2">Active: 20231020011742 (Thu Oct 19 20:17:42 2023)</span><o:p class="ContentPasted2"> </o:p></b></p>
<p class="MsoNormal ContentPasted2" style="margin:0in 0in 8pt;font-size:11pt;margin-bottom:0in">
Retired: 20231219011742 (Mon Dec 18 19:17:42 2023)<o:p class="ContentPasted2"> </o:p></p>
<p class="MsoNormal ContentPasted2" style="margin:0in 0in 8pt;font-size:11pt;margin-bottom:0in">
Removed: 20231229022242 (Thu Dec 28 20:22:42 2023)<o:p class="ContentPasted2"> </o:p></p>
<p class="MsoNormal ContentPasted2" style="margin:0in 0in 8pt;font-size:11pt;margin-bottom:0in">
DNSKEYChange: 20231019231242 (Thu Oct 19 18:12:42 2023)<o:p class="ContentPasted2"> </o:p></p>
<p class="MsoNormal ContentPasted2" style="margin:0in 0in 8pt;font-size:11pt;margin-bottom:0in">
ZRRSIGChange: 20231019231242 (Thu Oct 19 18:12:42 2023)<o:p class="ContentPasted2"> </o:p></p>
<p class="MsoNormal ContentPasted2" style="margin:0in 0in 8pt;font-size:11pt;margin-bottom:0in">
DNSKEYState: rumoured<o:p class="ContentPasted2"> </o:p></p>
<p class="MsoNormal ContentPasted2" style="margin:0in 0in 8pt;font-size:11pt;margin-bottom:0in">
ZRRSIGState: rumoured<o:p class="ContentPasted2"> </o:p></p>
<p class="MsoNormal ContentPasted2" style="margin:0in 0in 8pt;font-size:11pt;margin-bottom:0in">
GoalState: omnipresent<o:p class="ContentPasted2"> </o:p></p>
<br>
<p></p>
<p class="MsoNormal ContentPasted1" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
<o:p class="ContentPasted1"></o:p></p>
<p class="MsoNormal ContentPasted3" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
# dig @localhost myexample2.com DNSKEY +multi<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal ContentPasted3" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
; <<>> DiG 9.16.23-RH <<>> @localhost myexample2.com DNSKEY +multi<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal ContentPasted3" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
; (2 servers found)<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal ContentPasted3" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
;; global options: +cmd<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal ContentPasted3" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
;; Got answer:<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal ContentPasted3" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56141<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal ContentPasted3" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal ContentPasted3" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
;; OPT PSEUDOSECTION:<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal ContentPasted3" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
; EDNS: version: 0, flags:; udp: 1232<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal ContentPasted3" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
; COOKIE: cb17dbf88eab8fab010000006531b7fe20a031be5b4fab07 (good)<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal ContentPasted3" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
;; QUESTION SECTION:<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal ContentPasted3" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
;myexample2.com.<span style="mso-spacerun:yes" class="ContentPasted3">
</span>IN DNSKEY<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal ContentPasted3" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
;; ANSWER SECTION:<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal ContentPasted3" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
myexample2.com.<span style="mso-spacerun:yes" class="ContentPasted3"> </span>
3600 IN DNSKEY 257 3 13 (<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal ContentPasted3" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
<span style="mso-spacerun:yes" class="ContentPasted3">
</span>N7XVBtoat8ebr4jYDczH6cb/6WLJCYJ+A2h+wmQXh/Am<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal ContentPasted3" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
<span style="mso-spacerun:yes" class="ContentPasted3">
</span>F21xZsZ5awToRz6pC3Z11m1q1fOxN+JKa3x4xQOPIA==<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal ContentPasted3" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
<span style="mso-spacerun:yes" class="ContentPasted3">
</span>) ; KSK; alg = ECDSAP256SHA256 ; key id = 28233<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal ContentPasted3" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
myexample2.com.<span style="mso-spacerun:yes" class="ContentPasted3"> </span>
<span style="mso-spacerun:yes" class="ContentPasted3"> </span>3600 IN DNSKEY 256 3 13 (<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal ContentPasted3" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
<span style="mso-spacerun:yes" class="ContentPasted3">
</span>fInt/iKpWoqsQdIpninExDUyOUZCgM/tGl3I5vgoogpK<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal ContentPasted3" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
<span style="mso-spacerun:yes" class="ContentPasted3">
</span>ivBEwi9FRRUSMYpTY+etEWXGwSdm7jkHowrhjWz3ZQ==<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal ContentPasted3" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
<span style="mso-spacerun:yes" class="ContentPasted3">
</span>) ; <b><span style="background:yellow;mso-highlight:yellow" class="ContentPasted3">ZSK; alg = ECDSAP256SHA256 ; key id = 5264</span></b><o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal ContentPasted3" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
;; Query time: 1 msec<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal ContentPasted3" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
;; SERVER: 127.0.0.1#53(127.0.0.1)<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal ContentPasted3" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
;; WHEN: Thu Oct 19 18:13:02 CDT 2023<o:p class="ContentPasted3"> </o:p></p>
<p class="MsoNormal ContentPasted3" style="margin:0in 0in 8pt;font-size:11pt;font-family:"Calibri", sans-serif;margin-bottom:0in">
;; MSG SIZE<span style="mso-spacerun:yes" class="ContentPasted3"> </span>rcvd: 231<o:p class="ContentPasted3"> </o:p></p>
<br>
<p></p>
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div dir="ltr"><font style="font-size: 11pt; color: rgb(0, 0, 0);" face="Calibri, sans-serif" color="#000000"><b>From:</b> Mark Andrews <marka@isc.org><br>
<b>Sent:</b> Sunday, October 8, 2023 8:11 PM<br>
</font></div>
<div id="divRplyFwdMsg" dir="ltr" class="elementToProof"><font style="font-size: 11pt; color: rgb(0, 0, 0);" face="Calibri, sans-serif" color="#000000"><b>To:</b> Eddie Rowe <Eddie.Rowe@werdev.com><br>
</font></div>
<div dir="ltr"><font style="font-size: 11pt; color: rgb(0, 0, 0);" face="Calibri, sans-serif" color="#000000"><b>Cc:</b> bind-users@lists.isc.org <bind-users@lists.isc.org><br>
<b>Subject:</b> Re: KASP Rollover = Immediate Loss of DNSKEY (Why Do Inactive Keys Disappear?)</font>
<div class="PlainText elementToProof"> <br>
<br>
</div>
<div class="PlainText elementToProof">>Given the parent zone doesn’t have DS records for the zone and there is no >private trust anchor published,<br>
</div>
<div class="PlainText elementToProof">>there is no harm in changing the DNSKEYs immediately. Try again and this time >tell named that there are<br>
</div>
<div class="PlainText elementToProof">>DS records published for the zone. <br>
</div>
<div class="PlainText elementToProof"><br>
</div>
<div class="PlainText elementToProof">> rndc dnssec -keyid value -checkds published zone<br>
</div>
<div class="PlainText elementToProof"><br>
</div>
<div class="PlainText elementToProof">>This is also how you tell named about private trust anchors which are equivalent >to publishing DS records<br>
</div>
<div class="PlainText elementToProof">>in the parent.<br>
</div>
<div class="PlainText elementToProof"><br>
<br>
</div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt"></span></font></div>
</body>
</html>