<html aria-label="message body"><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><p data-start="126" data-end="136" class="PDq2pG_selectionAnchorContainer">Hi Ondřej,<span aria-hidden="true" class="PDq2pG_selectionAnchor"></span></p><p data-start="141" data-end="460">Thanks for the suggestion. My zones currently use <code data-start="191" data-end="203">YYYYMMDDNN</code> serials (e.g. <code data-start="218" data-end="230">2026072103</code>), which are numerically higher than the current Unix timestamp. A direct switch to <code data-start="314" data-end="324">date +%s</code> would therefore decrease the SOA serial. Is there a recommended migration strategy to move from <code data-start="421" data-end="433">YYYYMMDDNN</code> to Unix timestamp serials?</p><p data-start="465" data-end="479">Thanks,<br>Ajay</p><div><br><blockquote type="cite"><div>On 21 Jul 2026, at 10:06 PM, Ondřej Surý <ondrej@isc.org> wrote:</div><br class="Apple-interchange-newline"><div><meta charset="UTF-8"><span style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">Hi Ajay,</span><br style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;"><br style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;"><span style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">switch to unixtime serial number and the problem goes away. You will also get</span><br style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;"><span style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">a one-second granularity for the updates as free bonus. The YYYYMMDDNN</span><br style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;"><span style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">only allows 100 updates per-day.</span><br style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;"><br style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;"><span style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">Ondrej</span><br style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;"><span style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">--</span><br style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;"><span style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">Ondřej Surý (He/Him)</span><br style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;"><a href="mailto:ondrej@isc.org" style="font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;">ondrej@isc.org</a><br style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;"><br style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;"><span style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">ADHD brain at work: I sometimes lose track of my inbox. Please feel free to send a gentle nudge if you're waiting on a reply!</span><br style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;"><br style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;"><span style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours.</span><br style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;"><br style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;"><blockquote type="cite" style="font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;">On 21. 7. 2026, at 17:12, Ajay Guleria via bind-users <<a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a>> wrote:<br><br>Hello BIND Team,<br>We have deployed automatic DNSSEC signing for a production authoritative zone using BIND 9.18.39.<br>Environment<br> • BIND: 9.18.39<br> • Zone type: Primary<br> • Configuration:<br> • inline-signing yes;<br> • dnssec-policy "default";<br>rndc zonestatus reports:<br>serial: 2026072103<br>signed serial: 2026072300<br>inline signing: yes<br>key maintenance: automatic<br><br>DNSSEC validation is fully successful:<br>delv @8.8.8.8 example.com<br><br>; fully validated<br><br>The DS record has been published at the parent, and validation succeeds using Google Public DNS and Cloudflare.<br>Observation<br>The signed zone serial is maintained independently from the source zone serial.<br>For example:<br>Unsigned zone:<br>2026072103<br><br>Signed zone:<br>2026072300<br><br>After adding one DNS record:<br>Unsigned:<br>2026072103<br><br>Signed:<br>2026072301<br><br>This behavior is consistent with the documentation stating that the signed zone maintains its own SOA serial.<br>Operational issue<br>Many widely used monitoring tools (MXToolbox, IntoDNS, DNS Spy, and others) interpret the served SOA serial as a YYYYMMDDNN date-based serial.<br>As a result, they report warnings such as:<br>SOA Serial Number Format is Invalid<br><br>Serial: 2026072300<br><br>Serial date was 2026-07-23 which is in the future.<br><br>Although DNSSEC validation is correct, these warnings generate operational tickets and user concerns.<br>Questions<br> 1. Is this independent signed serial expected behavior for BIND 9.18.39 with dnssec-policy and inline-signing?<br> 2. Is there any supported configuration that preserves the source SOA serial in the served signed zone while still allowing automatic signing and automatic key maintenance?<br> 3. If not, would ISC consider adding an optional configuration (for example, a policy or zone option) that allows the served signed zone to retain the source SOA serial where administrators intentionally use YYYYMMDDNN serial numbering?<br>Thank you for any clarification.<br>--<span class="Apple-converted-space"> </span><br>Visit<span class="Apple-converted-space"> </span><a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a><span class="Apple-converted-space"> </span>to unsubscribe from this list.<br></blockquote><br style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;"><span style="caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">CAUTION: This email originated from outside of IIT Delhi. Do not click links or open attachments unless you recognize the sender and know the content is safe.</span></div></blockquote></div><br></body></html>