<div>HI Peter </div><div><br></div><div>So as you said key rollovers are not mandate,so that means if i created ksk and zsk for a domain so that will last long during a zone lifecycle till its live and secured</div><div>So i am new to dnssec can you please give me the best practice in handling keys like when should i intentionally go for a key rollover and which key is to be rollovered ksk or zsk or both and how frequent.</div>
<div>Please show some light on this.</div><div><br></div><div>Thanks & Regards</div><div>Parth Monga</div><div>Net4 India Ltd</div><div> </div><div><br></div><span style>Date: Fri, 13 Apr 2012 13:30:37 +0200</span><br style>
<span style>From: Peter van Dijk <</span><a href="mailto:peter.van.dijk@netherlabs.nl" style>peter.van.dijk@netherlabs.nl</a><span style>></span><br style><span style>Subject: Re: [Pdns-users] Pdns-users Digest, Vol 111, Issue 16</span><br style>
<span style>To: pdns-users Users <</span><a href="mailto:pdns-users@mailman.powerdns.com" style>pdns-users@mailman.powerdns.com</a><span style>></span><br style><span style>Message-ID: <</span><a href="mailto:A0334D1A-2895-48D1-A60B-2E11B7C9AEC0@netherlabs.nl" style>A0334D1A-2895-48D1-A60B-2E11B7C9AEC0@netherlabs.nl</a><span style>></span><br style>
<span style>Content-Type: text/plain; charset=iso-8859-1</span><br style><br style><span style>Hi,</span><br style><br style><span style>On Apr 13, 2012, at 13:25 , PARTH MONGA wrote:</span><br style><br style><span style>> Hi Peter</span><br style>
<span style>></span><br style><span style>> Can you please also update me about</span><br style><span style>> how to set NSEC3 narrow settings for a secured zone and how to do the same in NSEC3 inclusive mode.</span><br style>
<br style><span style>Please read</span><br style><a href="http://doc.powerdns.com/pdnssec.html" target="_blank" style>http://doc.powerdns.com/pdnssec.html</a><br style><a href="http://doc.powerdns.com/domainmetadata.html" target="_blank" style>http://doc.powerdns.com/domainmetadata.html</a><br style>
<br style><span style>> And as Jose said in the very first reply,Can you please confirm me that do i have to perform a key rollover if i make any changes in a secure zone or PDNS manages that part automatically.</span><br style>
<br style><span style>Key rollovers are never mandatory (except when changing from NSEC to NSEC3 on a domain where DS records have already been published to the parent). PDNS does not manage key rollovers automatically, by the way.</span><br style>
<br style><span style>Kind regards,</span><br style><span style>--</span><br style><span style>Peter van Dijk</span><br style><span style>Netherlabs Computer Consulting BV - </span><a href="http://www.netherlabs.nl/" target="_blank" style>http://www.netherlabs.nl/</a><br style>
<br><div class="gmail_quote">On Sat, Apr 14, 2012 at 3:30 PM, <span dir="ltr"><<a href="mailto:pdns-users-request@mailman.powerdns.com">pdns-users-request@mailman.powerdns.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Send Pdns-users mailing list submissions to<br>
<a href="mailto:pdns-users@mailman.powerdns.com">pdns-users@mailman.powerdns.com</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="http://mailman.powerdns.com/mailman/listinfo/pdns-users" target="_blank">http://mailman.powerdns.com/mailman/listinfo/pdns-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:pdns-users-request@mailman.powerdns.com">pdns-users-request@mailman.powerdns.com</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:pdns-users-owner@mailman.powerdns.com">pdns-users-owner@mailman.powerdns.com</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of Pdns-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: Pdns-users Digest, Vol 111, Issue 16 (PARTH MONGA)<br>
2. Re: Pdns-users Digest, Vol 111, Issue 16 (Peter van Dijk)<br>
3. Re: Strange recursor TTL behaviour for specific host<br>
(Wouter de Jong)<br>
4. Re: Strange recursor TTL behaviour for specific host<br>
(Peter van Dijk)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Fri, 13 Apr 2012 16:55:10 +0530<br>
From: PARTH MONGA <<a href="mailto:kprprl@gmail.com">kprprl@gmail.com</a>><br>
Subject: Re: [Pdns-users] Pdns-users Digest, Vol 111, Issue 16<br>
To: <a href="mailto:pdns-users@mailman.powerdns.com">pdns-users@mailman.powerdns.com</a><br>
Cc: <a href="mailto:peter.van.dijk@netherlabs.nl">peter.van.dijk@netherlabs.nl</a><br>
Message-ID:<br>
<CACBBYcN_nV0PMZNhH7SCQ3dcxLx2p60V2_jPm=<a href="mailto:RWtxtx%2Bakk3g@mail.gmail.com">RWtxtx+akk3g@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="iso-8859-1"<br>
<br>
Hi Peter<br>
<br>
Thanks a lot for the valuable input.<br>
Appreciated!!!!!!!<br>
So i think am close to wrap up my installation with 9 nodes in the cluster<br>
Can you please also update me about<br>
how to set NSEC3 narrow settings for a secured zone and how to do the same<br>
in NSEC3 inclusive mode.<br>
<br>
And as Jose said in the very first reply,Can you please confirm me that do<br>
i have to perform a key rollover if i make any changes in a secure zone or<br>
PDNS manages that part automatically.<br>
<br>
Info would of great help in my setup.<br>
Really appreciated your's and jose input on my queries<br>
<br>
Thanks a lot<br>
<br>
Best Regards<br>
Parth Monga<br>
<br>
> 2-When it is advised to roll over the keys in DNSSEC secured zones.DO i<br>
have to roll over the keys each time when i make changes to a secured zone<br>
data(like changing A records or Mx Records) or it will be automatically<br>
taken care by PDNS.Please elaborate this key roll over mechanism,a lot of<br>
confusion is there..<br>
<br>
Taken from the manual:<br>
<br>
"PowerDNS supports serving pre-signed zones, as well as online<br>
('live') signed operations. In the last case, Signature Rollover and<br>
Key Maintenance are fully managed by PowerDNS."<br>
<br>
When you add / remove records, you need to call 'pdnssec rectify-zone<br>
<a href="http://example.com" target="_blank">example.com</a>' to make sure that the records orders are set properly.<br>
This is important to use NSEC, that need the record before and after<br>
to give a signed denial of existence. As far I remember, the field<br>
content is not use in NSEC, so you can change this at will.<br>
><br>
<br>
<br>
On Fri, Apr 13, 2012 at 3:30 PM, <<a href="mailto:pdns-users-request@mailman.powerdns.com">pdns-users-request@mailman.powerdns.com</a>>wrote:<br>
<br>
> Send Pdns-users mailing list submissions to<br>
> <a href="mailto:pdns-users@mailman.powerdns.com">pdns-users@mailman.powerdns.com</a><br>
><br>
> To subscribe or unsubscribe via the World Wide Web, visit<br>
> <a href="http://mailman.powerdns.com/mailman/listinfo/pdns-users" target="_blank">http://mailman.powerdns.com/mailman/listinfo/pdns-users</a><br>
> or, via email, send a message with subject or body 'help' to<br>
> <a href="mailto:pdns-users-request@mailman.powerdns.com">pdns-users-request@mailman.powerdns.com</a><br>
><br>
> You can reach the person managing the list at<br>
> <a href="mailto:pdns-users-owner@mailman.powerdns.com">pdns-users-owner@mailman.powerdns.com</a><br>
><br>
> When replying, please edit your Subject line so it is more specific<br>
> than "Re: Contents of Pdns-users digest..."<br>
><br>
><br>
> Today's Topics:<br>
><br>
> 1. Re: Huge PDNS+DNSSEC setup-Need help (Peter van Dijk)<br>
><br>
><br>
> ----------------------------------------------------------------------<br>
><br>
> Message: 1<br>
> Date: Fri, 13 Apr 2012 10:58:00 +0200<br>
> From: Peter van Dijk <<a href="mailto:peter.van.dijk@netherlabs.nl">peter.van.dijk@netherlabs.nl</a>><br>
> Subject: Re: [Pdns-users] Huge PDNS+DNSSEC setup-Need help<br>
> To: pdns-users Users <<a href="mailto:pdns-users@mailman.powerdns.com">pdns-users@mailman.powerdns.com</a>><br>
> Message-ID: <<a href="mailto:883423D7-537D-472A-A01E-A7FBAF4144B7@netherlabs.nl">883423D7-537D-472A-A01E-A7FBAF4144B7@netherlabs.nl</a>><br>
> Content-Type: text/plain; charset=iso-8859-1<br>
><br>
> Hi,<br>
><br>
> On Apr 13, 2012, at 10:37 , PARTH MONGA wrote:<br>
><br>
> > That for sure i will go with NSEC3 but whom to actually hit<br>
> > NSEC3-inclusive or NSEC3-narrow<br>
> ><br>
> > Please advice as not able to figure the difference between both NSEC3<br>
> modes.<br>
><br>
> Benefits of narrow mode:<br>
> - order name field does not matter (auth field still does)<br>
> - no brute forcing calculation of names in your zones<br>
><br>
> Downsides of narrow mode:<br>
> - you cannot have AXFR slaves, all slaves need to be NATIVE (which would<br>
> work for you)<br>
><br>
> Benefits of inclusive mode:<br>
> - behaviour is closer to what other name servers do, easier to understand<br>
> when you get a DNSSEC expert to debug something<br>
> - receives more testing than narrow<br>
><br>
> Kind regards,<br>
> --<br>
> Peter van Dijk<br>
> Netherlabs Computer Consulting BV - <a href="http://www.netherlabs.nl/" target="_blank">http://www.netherlabs.nl/</a><br>
><br>
><br>
><br>
> ------------------------------<br>
><br>
> _______________________________________________<br>
> Pdns-users mailing list<br>
> <a href="mailto:Pdns-users@mailman.powerdns.com">Pdns-users@mailman.powerdns.com</a><br>
> <a href="http://mailman.powerdns.com/mailman/listinfo/pdns-users" target="_blank">http://mailman.powerdns.com/mailman/listinfo/pdns-users</a><br>
><br>
><br>
> End of Pdns-users Digest, Vol 111, Issue 16<br>
> *******************************************<br>
><br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://mailman.powerdns.com/pipermail/pdns-users/attachments/20120413/dcdc8ac7/attachment.html" target="_blank">http://mailman.powerdns.com/pipermail/pdns-users/attachments/20120413/dcdc8ac7/attachment.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Fri, 13 Apr 2012 13:30:37 +0200<br>
From: Peter van Dijk <<a href="mailto:peter.van.dijk@netherlabs.nl">peter.van.dijk@netherlabs.nl</a>><br>
Subject: Re: [Pdns-users] Pdns-users Digest, Vol 111, Issue 16<br>
To: pdns-users Users <<a href="mailto:pdns-users@mailman.powerdns.com">pdns-users@mailman.powerdns.com</a>><br>
Message-ID: <<a href="mailto:A0334D1A-2895-48D1-A60B-2E11B7C9AEC0@netherlabs.nl">A0334D1A-2895-48D1-A60B-2E11B7C9AEC0@netherlabs.nl</a>><br>
Content-Type: text/plain; charset=iso-8859-1<br>
<br>
Hi,<br>
<br>
On Apr 13, 2012, at 13:25 , PARTH MONGA wrote:<br>
<br>
> Hi Peter<br>
><br>
> Can you please also update me about<br>
> how to set NSEC3 narrow settings for a secured zone and how to do the same in NSEC3 inclusive mode.<br>
<br>
Please read<br>
<a href="http://doc.powerdns.com/pdnssec.html" target="_blank">http://doc.powerdns.com/pdnssec.html</a><br>
<a href="http://doc.powerdns.com/domainmetadata.html" target="_blank">http://doc.powerdns.com/domainmetadata.html</a><br>
<br>
> And as Jose said in the very first reply,Can you please confirm me that do i have to perform a key rollover if i make any changes in a secure zone or PDNS manages that part automatically.<br>
<br>
Key rollovers are never mandatory (except when changing from NSEC to NSEC3 on a domain where DS records have already been published to the parent). PDNS does not manage key rollovers automatically, by the way.<br>
<br>
Kind regards,<br>
--<br>
Peter van Dijk<br>
Netherlabs Computer Consulting BV - <a href="http://www.netherlabs.nl/" target="_blank">http://www.netherlabs.nl/</a><br>
<br>
<br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Fri, 13 Apr 2012 17:59:08 +0200<br>
From: Wouter de Jong <<a href="mailto:wouter@widexs.nl">wouter@widexs.nl</a>><br>
Subject: Re: [Pdns-users] Strange recursor TTL behaviour for specific<br>
host<br>
To: pdns-users Users <<a href="mailto:pdns-users@mailman.powerdns.com">pdns-users@mailman.powerdns.com</a>><br>
Message-ID: <<a href="mailto:20120413155907.GA57124@widexs.nl">20120413155907.GA57124@widexs.nl</a>><br>
Content-Type: text/plain; charset=us-ascii<br>
<br>
Hi Peter,<br>
<br>
On Thu, Apr 12, 2012 at 08:09:01PM +0200, Peter van Dijk wrote:<br>
<br>
> > As you can see, TTL 37 -> 34 -> 30 -> 27 -> 24 -> 32<br>
> ><br>
> > I'm wondering what could be causing this ?<br>
><br>
> Try threads=1 in recursor.conf. If that causes it, there is no need for alarm :)<br>
<br>
Great, that seems to explain it indeed :)<br>
<br>
Apparently, default threads= setting > 1 ?<br>
<br>
Best regards,<br>
<br>
Wouter<br>
<br>
<br>
------------------------------<br>
<br>
Message: 4<br>
Date: Sat, 14 Apr 2012 11:10:39 +0200<br>
From: Peter van Dijk <<a href="mailto:peter.van.dijk@netherlabs.nl">peter.van.dijk@netherlabs.nl</a>><br>
Subject: Re: [Pdns-users] Strange recursor TTL behaviour for specific<br>
host<br>
To: pdns-users Users <<a href="mailto:pdns-users@mailman.powerdns.com">pdns-users@mailman.powerdns.com</a>><br>
Message-ID: <<a href="mailto:A7CBB02F-94E3-44F8-8C76-780F06C77693@netherlabs.nl">A7CBB02F-94E3-44F8-8C76-780F06C77693@netherlabs.nl</a>><br>
Content-Type: text/plain; charset=us-ascii<br>
<br>
Hi Wouter,<br>
<br>
On Apr 13, 2012, at 17:59 , Wouter de Jong wrote:<br>
<br>
> Apparently, default threads= setting > 1 ?<br>
<br>
<br>
Yes - see 'pdns_recursor --config' for all defaults.<br>
<br>
Kind regards,<br>
--<br>
Peter van Dijk<br>
Netherlabs Computer Consulting BV - <a href="http://www.netherlabs.nl/" target="_blank">http://www.netherlabs.nl/</a><br>
<br>
<br>
<br>
------------------------------<br>
<br>
_______________________________________________<br>
Pdns-users mailing list<br>
<a href="mailto:Pdns-users@mailman.powerdns.com">Pdns-users@mailman.powerdns.com</a><br>
<a href="http://mailman.powerdns.com/mailman/listinfo/pdns-users" target="_blank">http://mailman.powerdns.com/mailman/listinfo/pdns-users</a><br>
<br>
<br>
End of Pdns-users Digest, Vol 111, Issue 17<br>
*******************************************<br>
</blockquote></div><br>