<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
As far as I have been able to determine through some fairly
extensive reading, a feature I depend on has fallen out of favor
with the BIND developers, and is being removed.<br>
DNSSEC in 9.18 has two automatic actions where the original code had
just one, and the second cannot be disabled.<br>
I am referring to the deprecated feature:<br>
<p><code class=" language-text"
style="font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, Courier, monospace; font-size: 14.44px; line-height: 1.5; font-weight: normal; color: black; background: none; white-space: pre; display: inline-block; text-shadow: white 0px 1px; text-align: left; word-spacing: normal; word-break: normal; overflow-wrap: normal; tab-size: 4; hyphens: none;">auto-dnssec maintain;</code></p>
<p><code class=" language-text"
style="font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, Courier, monospace; font-size: 14.44px; line-height: 1.5; font-weight: normal; color: black; background: none; white-space: pre; display: inline-block; text-shadow: white 0px 1px; text-align: left; word-spacing: normal; word-break: normal; overflow-wrap: normal; tab-size: 4; hyphens: none;"></code>Originally
(under the above command) RR records for DNSSEC were maintained by
<font face="monospace">bind</font>, but the ZSK and KSK keys were
maintained by me. This command is being discarded. I understand
that <font face="monospace">bind </font>"sort of" supports this
feature in 9.18 by allowing the DNSSEC policy statement to declare
unlimited lifetime, but after careful reading of the documentation
and reading a number of complaints, it turns out that <font
face="monospace">bind </font>may under various circumstances
decide that it is appropriate not to use existing keys and decide
that it knows best, and then it makes new ones. This potential
instability of course would be disastrous, and completely
unnecessary.<br>
</p>
<p>I am sure there are the usual people that will assure me I don't
or shouldn't want to do what I am doing, but I am experienced and
have good reasons. Yes I know that I can have <font
face="monospace">bind </font>update the DS records, but for
good reason I definitely do not want to do that. I need some
syntax that assures my use of existing KSK and ZSK keys and
prevents <font face="monospace">bind </font>from changing them.
<br>
</p>
<p>I wonder if the bind developers are open to allowing a command in
the new policy statement structure that blocks this 'feature' of
automatically updating ZSK and KSK? If there is such a thing
already, I will be delighted to hear that I had missed seeing it.<br>
</p>
<p>A lot of pain and suffering in this world comes from people being
sure they have a 'better idea' and everybody needs to do
whatever. This feels a bit like that. A command that gives
choice and real certainty would be great.<br>
</p>
</body>
</html>