22 Dub
2025
22 Dub
'25
16:45
Hi,
this happened to me for the second time, that https://dnsviz.net
<https://dnsviz.net/> tells me:
| enfer-du-nord.net/CDNSKEY: The CDNSKEY RRset must be signed with a key that is
represented in both the
| current DNSKEY and the current DS RRset. See RFC 7344, Sec. 4.1.
| enfer-du-nord.net/CDS: The CDS RRset must be signed with a key that is represented in
both the current
| DNSKEY and the current DS RRset. See RFC 7344, Sec. 4.1.
I do not understand what that means.
#) I haven't modified my KSK for some time now
#) I did notify my parent zone about a modified list of nameservers (via registrar's
web portal)
I am not absolutely sure if the latter is the cause for these error messages.
I 'fixed' that issue by re-uploading my unmodified KSK DNSKEY (via registrar's
web portal).
Hmm, how can I fix that issue the right way?
Any hints are highly welcome,
Michael
22 Dub
22 Dub
17:19
Hi
Your DS in .NET was missing at this point
https://dnsviz.net/d/enfer-du-nord.net/aAeeOQ/dnssec/.
So You did solve it the correct way. (If You do not use autoprovisioning as
described in rfc8078 but i haven't found a way to do that in .NET TLD)
I don't know how or why it was removed though but it is probably something
that happened at Your registrar.
/Leif
On Tue, Apr 22, 2025 at 4:46 PM Michael Grimm via knot-dns-users <
knot-dns-users(a)lists.nic.cz> wrote:
Hi,
this happened to me for the second time, that https://dnsviz.net <
https://dnsviz.net/> tells me:
| enfer-du-nord.net/CDNSKEY: The CDNSKEY RRset must be signed with a key
that is represented in both the
| current DNSKEY and the current DS RRset. See RFC 7344, Sec. 4.1.
| enfer-du-nord.net/CDS: The CDS RRset must be signed with a key that is
represented in both the current
| DNSKEY and the current DS RRset. See RFC 7344, Sec. 4.1.
I do not understand what that means.
#) I haven't modified my KSK for some time now
#) I did notify my parent zone about a modified list of nameservers (via
registrar's web portal)
I am not absolutely sure if the latter is the cause for these error
messages.
I 'fixed' that issue by re-uploading my unmodified KSK DNSKEY (via
registrar's web portal).
Hmm, how can I fix that issue the right way?
Any hints are highly welcome,
Michael
--
19:28
Leif Gustafsson <leffeg65(a)gmail.com> wrote:
Your DS in .NET was missing at this point
https://dnsviz.net/d/enfer-du-nord.net/aAeeOQ/dnssec/.
So You did solve it the correct way. (If You do not
use autoprovisioning as described in rfc8078 but i haven't found a way to do that in
.NET TLD)
Thanks for pointing me to this. I set this up when I started to use knot, then I found out
that none of my TLD are capable of following RFC8078, and then I forgot to remove them.
That I have done now.
I don't know how or why it was removed though but
it is probably something that happened at Your registrar.
Yes :-( All of my 7 zones needed additional secondary name servers. And during this
process of configure them in my registrar's GUI, their scripts obviously removed all
zones' DS records in addition :-(
Well, now I do have to look for a new registrar who knows how to provide DNSSEC services
to customers running their own name servers.
Any recommendations?
Regards,
Michael
17:24
On Tue, Apr 22, 2025 at 04:45:43PM CEST, Michael Grimm via knot-dns-users
<knot-dns-users(a)lists.nic.cz> said:
Hi,
this happened to me for the second time, that https://dnsviz.net
<https://dnsviz.net/> tells me:
| enfer-du-nord.net/CDNSKEY: The CDNSKEY RRset must be signed with a key that is
represented in both the
| current DNSKEY and the current DS RRset. See RFC 7344, Sec. 4.1.
| enfer-du-nord.net/CDS: The CDS RRset must be signed with a key that is represented in
both the current
| DNSKEY and the current DS RRset. See RFC 7344, Sec. 4.1.
I do not understand what that means.
#) I haven't modified my KSK for some time now
#) I did notify my parent zone about a modified list of nameservers (via registrar's
web portal)
I am not absolutely sure if the latter is the cause for these error messages.
I 'fixed' that issue by re-uploading my unmodified KSK DNSKEY (via
registrar's web portal).
Hmm, how can I fix that issue the right way?
Any hints are highly welcome,
Michael
I only have a CDS key in my zone when there is a KSK rollover. The CDS contains the data
you should
add as DS in the parent zone.
I never checked its signature, I setr up knot to check the DS publication, and the CDS
disappear once the new DS is published.
--
Erwan David
19:32
Erwan David <erwan(a)rail.eu.org> wrote:
I only have a CDS key in my zone when there is a KSK
rollover. The CDS contains the data you should
add as DS in the parent zone.
I have removed CDS/CDNSKEY completely, because I do not need them for .de, .org, and .net
for the time being.
Regards,
Michael
19:55
I'm happy to say tha .se, .nu and also ripe (for reverse zones) works with
RFC8078 and I have it running so now I do automatic KSK rollovers 4
times/year.
RFC7477 is also implemented on .se and .nu so I can manage my NS pointers
in my local zones and sync via CSYNC RR, very nice.
/Leif
On Tue, Apr 22, 2025 at 7:32 PM Michael Grimm via knot-dns-users <
knot-dns-users(a)lists.nic.cz> wrote:
Erwan David <erwan(a)rail.eu.org> wrote:
I only have a CDS key in my zone when there is a
KSK rollover. The CDS
contains the data you should
add as DS in the parent zone.
I have removed CDS/CDNSKEY completely, because I do not need them for .de,
.org, and .net for the time being.
Regards,
Michael
--
23 Dub
23 Dub
7:50
Hi,
Here is the best list of TLDs with the support https://github.com/oskar456/cds-updates
Daniel
On 4/22/25 19:55, Leif Gustafsson wrote:
I'm happy to say tha .se, .nu and also ripe (for
reverse zones) works with RFC8078 and I have it running so now I do automatic KSK
rollovers 4 times/year.
RFC7477 is also implemented on .se and .nu so I can manage my NS pointers in my local
zones and sync via CSYNC RR, very nice.
/Leif
On Tue, Apr 22, 2025 at 7:32 PM Michael Grimm via knot-dns-users
<knot-dns-users(a)lists.nic.cz <mailto:knot-dns-users@lists.nic.cz>> wrote:
Erwan David <erwan(a)rail.eu.org <mailto:erwan@rail.eu.org>> wrote:
I only have a CDS key in my zone when there is a
KSK rollover. The CDS contains the data you should
add as DS in the parent zone.
I have removed CDS/CDNSKEY completely, because I do not need them for .de, .org, and
.net for the time being.
Regards,
Michael
--
--
86
days inactive
87
days old
6 comments
4 participants
participants (4)
-
Daniel Salzman -
Erwan David -
Leif Gustafsson -
Michael Grimm