Checking ahead of the DNSSEC root KSK rollover ... all my resolvers have a ttl > 24h for the root DNSKEY RRset, so I plan to give them a delicate kick after H-hour to ensure things are OK before I head to Amsterdam tomorrow
3
3
6
I've had to deal with a number of KSK rollovers for the first time in production recently. I only fluffed up one of them (the most important one) :-) I need to see if I can automate GANDI to update the KSKs
2
I understand GANDI is in on CDS/CDNSKEY, should make things easier
2
Oooh whassat?
2
you publish intended parent-side DS on your side as CDS; parent monitors this, trusts it after a few days and adopts it. CDNSKEY is the obvious non-hashed variant.
2
Replying to @Habbie @fanf
So, if I publish the DS and DNSKEY records I want as CDS/CDNSKEY respectively, Gandi (possibly after some configuration) will automatically pick them up, meaning that as I introduce the new KSK, it will pick itup automatically etc?

Oct 11, 2018 ยท 12:25 PM UTC

1
Replying to @dsilverstone @fanf
that is the idea. It's unclear to me how far along their implementation/deployment is.
1
I've popped onto IRC to find out