-1

Please help me to clarify my doubts,

I have a doubt regarding DNSSEC Key Roll Over.

If any specific reason to resign every domain within a time period?

If it gets resigned and regenerated KSK and ZSK did I need to update new DS record at registrar end?

What are the things need to be done after a DNSSEC resigning process?

Thanks.

Amal P Ramesh
  • 131
  • 5
  • 2
    Stack Overflow is a site for programming and development questions. This question appears to be off-topic because it is not about programming or development. See [What topics can I ask about here](http://stackoverflow.com/help/on-topic) in the Help Center. Perhaps [Super User](http://superuser.com/) or [Unix & Linux Stack Exchange](http://unix.stackexchange.com/) would be a better place to ask. – jww Sep 06 '18 at 11:59

1 Answers1

0

Your question is too vague/unclear/off topic.

But in broad terms: only if you change the KSK you need to change the DS at the parent.

If you change the ZSK it just needs to be resigned by the current KSKs. You can also uploads new DS records in advance of putting the related key in the zone.

Keys/Protocol rollovers are tricky especially if you try to make them happen too fast. You need to take into account both DNS TTLs (of the signatures, of the DNSKEY records in the zone, of the DS records in the parent zone), and signatures start/end dates.

This is the canonical document to read to be prepared for a rollover: https://www.rfc-editor.org/rfc/rfc7583

This document describes the issues surrounding the timing of events in the rolling of a key in a DNSSEC-secured zone. It presents timelines for the key rollover and explicitly identifies the relationships between the various parameters affecting the process.

Start by reading it, multiple times. Then if you have questions, I think ServerFault might me more on topic than here, check its Tour and Help pages first.

Community
  • 1
  • 1
Patrick Mevzek
  • 10,995
  • 16
  • 38
  • 54