<!DOCTYPE html>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi all,</p>
<p>yesterday I filled my day fiddling with DNSSEC for a couple of my
test domains - both have been signed 'manually' before, but I
haven't published the DS record.<br>
</p>
<p><br>
</p>
<p>So yesterday I setup both for dnssec-policy, while also changing
the signing algorithm and keys (basically started from scratch):</p>
<pre>dnssec-policy "nsec3_no_rotate" {
keys {
ksk key-directory lifetime unlimited algorithm 13;
zsk key-directory lifetime unlimited algorithm 13;
};
nsec3param iterations 0 optout false;
};
...
zone "sociopat.si" {
type master;
file "master/Danci/sociopat.si.hosts";
key-directory "master/Danci/keys";
dnssec-policy "nsec3_no_rotate";
inline-signing yes;
};
zone "psihopat.si" {
type master;
file "master/Danci/psihopat.si.hosts";
key-directory "master/Danci/keys";
dnssec-policy "nsec3_no_rotate";
inline-signing yes;
};
...
</pre>
<p><br>
</p>
<p>I published DS records through my registrar and after a couple of
hours all seemed fine - both Verisign dnssec-analyzer and DNSViz
show no errors or warnings for them.</p>
<p><br>
</p>
<p>However, today bind logged this:</p>
<pre>named[17379]: general: info: CDNSKEY for key sociopat.si/ECDSAP256SHA256/61220 is now published
named[17379]: general: info: CDS for key sociopat.si/ECDSAP256SHA256/61220 is now published
</pre>
<p><br>
</p>
<p>I'm pretty sure this is not bad or wrong, but I would like to
sort-of understand, why Bind decided it needs to publish CDS /
CDNSKEY for this one and not the other one, given that DS records
are published in ccTLDs:</p>
<pre># dig ds sociopat.si
;; QUESTION SECTION:
;sociopat.si. IN DS
;; ANSWER SECTION:
sociopat.si. 5826 IN DS 61220 13 2 D8C1553B3D6BCF7A704A3D821069F57B6946DCA1D198D303E3B4C730 616F92AD
# dig ds psihopat.si
;; QUESTION SECTION:
;psihopat.si. IN DS
;; ANSWER SECTION:
psihopat.si. 7200 IN DS 7162 13 2 3C5A5625F848DBCF99A0B85017AFE04FD1F681037B61BE970D57AE9F 90F21CD8
</pre>
<p><br>
</p>
<p>Also, as far as I know, .si DNS servers don't support CDS /
CDNSKEY, so publishing them might be futile.<br>
</p>
<p><br>
</p>
<p> Regards,<br>
<br>
Danilo</p>
<p><br>
</p>
<p></p>
</body>
</html>