<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; "><div><font class="Apple-style-span" face="Consolas"><span class="Apple-style-span" style="font-size: medium;">A have been trying to automate this all and have a number of questions…</span></font></div><div><font class="Apple-style-span" face="Consolas"><span class="Apple-style-span" style="font-size: medium;"><br></span></font></div><ol><li><font class="Apple-style-span" face="Consolas"><span class="Apple-style-span" style="font-size: medium;"><a href="http://doc.powerdns.com/dnssec-operational-doctrine.html">http://doc.powerdns.com/dnssec-operational-doctrine.html</a> say to use "</span></font><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; ">pdnssec disable-dnssec" but there is no command so what the "proper" way of making a domain insecure (the opposite of secure-zone basically. remove-zone-key on all the keys will work? And then update SOA serial and remove anything in the domainmetadata table?</span></li></ol><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium;"><br></span></font></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium;"><br></span></font></div><div><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; ">2) pdnssec [options] [show-zone] [secure-zone] [rectify-zone] [add-zone-key] [deactivate-zone-key] [remove-zone-key] [activate-zone-key]</span></div><div><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; "><div> [import-zone-key] [export-zone-key] [set-nsec3] [set-presigned] [unset-nsec3] [unset-presigned] [export-zone-dnskey]</div><div><br></div><div>…</div><div>secure-zone Add KSK and two ZSKs</div><div>…</div><div><br></div><div>Should be</div><div><br></div><div>secure-zone ZONE Add KSK and two ZSKs</div><div><br></div><div>3) do I have to run rectify-zone every time I add/change an entry. I add an entry into the database and then read the SOA and increase it and update it to be bigger.</div><div><br></div><div>insert into records (domain_id,name,content,type,ttl,prio) values ("1","test44.spam.co.nz","114.23.33.130","A",86400,NULL);</div><div><div>update records set content = "ns1.spam.co.nz support@spam.co.nz 4000 28800 7200 604800 86400" where id = "1";</div></div><div><br></div><div><br></div><div><div>mysql> select * from records where id = "38";</div><div>+----+-----------+-------------------+------+---------------+-------+------+-------------+-----------+------+</div><div>| id | domain_id | name | type | content | ttl | prio | change_date | ordername | auth |</div><div>+----+-----------+-------------------+------+---------------+-------+------+-------------+-----------+------+</div><div>| 38 | 1 | test44.spam.co.nz | A | 114.23.33.130 | 86400 | NULL | NULL | NULL | NULL |</div><div>+----+-----------+-------------------+------+---------------+-------+------+-------------+-----------+------+</div><div>1 row in set (0.00 sec)</div></div><div><br></div><div>Update not showing at all until I run pdnssec rectify-zone spam.co.nz</div><div>And the data now looks like</div><div><br></div><div><br></div><div><div>select * from records where id = "38";</div><div>+----+-----------+-------------------+------+---------------+-------+------+-------------+----------------------------------+------+</div><div>| id | domain_id | name | type | content | ttl | prio | change_date | ordername | auth |</div><div>+----+-----------+-------------------+------+---------------+-------+------+-------------+----------------------------------+------+</div><div>| 38 | 1 | test44.spam.co.nz | A | 114.23.33.130 | 86400 | NULL | NULL | qi3g5evlihaplneaqgjgnncntd9ms95b | 1 |</div><div>+----+-----------+-------------------+------+---------------+-------+------+-------------+----------------------------------+------+</div><div>1 row in set (0.00 sec)</div></div><div><br></div><div>And I can dig the new entry..</div><div><br></div><div>Thanks</div><div>Craig</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></span></div></body></html>