<div style>HI Peter </div><div style><br></div><div style>So as you said key rollovers are not mandate,so that means if i created ksk and zsk for a domain so that will last long during a zone lifecycle till its live and secured</div>
<div style>So i am new to dnssec can you please give me the best practice in handling keys like when should i intentionally go for a key rollover and which key is to be rollovered ksk or zsk or both and how frequent.</div>
<div style>Please show some light on this.</div><div style><br></div><div style>Thanks & Regards</div><div class="yj6qo ajU" style><div id=":10r" class="ajR" tabindex="0" style="background-color:rgb(241,241,241);border-top-width:1px;border-right-width:1px;border-bottom-width:1px;border-left-width:1px;border-top-style:solid;border-right-style:solid;border-bottom-style:solid;border-left-style:solid;border-top-color:rgb(221,221,221);border-right-color:rgb(221,221,221);border-bottom-color:rgb(221,221,221);border-left-color:rgb(221,221,221);clear:both;line-height:6px;outline-style:none;outline-width:initial;outline-color:initial;width:20px">
<img class="ajT" src="https://mail.google.com/mail/images/cleardot.gif" style="background-image: url(https://ssl.gstatic.com/ui/v1/icons/mail/ellipsis.png); background-attachment: initial; background-origin: initial; background-clip: initial; background-color: initial; height: 8px; opacity: 0.3; width: 20px; background-position: initial initial; background-repeat: no-repeat no-repeat; "></div>
</div><span class="HOEnZb adL" style><font color="#888888"><div>Parth Monga</div><div>Net4 India Ltd</div></font></span><div class="im HOEnZb adL" style><div> </div><div><br></div>Date: Fri, 13 Apr 2012 13:30:37 +0200<br>
From: Peter van Dijk <<a href="mailto:peter.van.dijk@netherlabs.nl" target="_blank" style="color:rgb(17,85,204)">peter.van.dijk@netherlabs.nl</a>><br>Subject: Re: [Pdns-users] Pdns-users Digest, Vol 111, Issue 16<br>
To: pdns-users Users <<a href="mailto:pdns-users@mailman.powerdns.com" target="_blank" style="color:rgb(17,85,204)">pdns-users@mailman.powerdns.com</a>><br>Message-ID: <<a href="mailto:A0334D1A-2895-48D1-A60B-2E11B7C9AEC0@netherlabs.nl" target="_blank" style="color:rgb(17,85,204)">A0334D1A-2895-48D1-A60B-2E11B7C9AEC0@netherlabs.nl</a>><br>
Content-Type: text/plain; charset=iso-8859-1<br><br>Hi,<br><br>On Apr 13, 2012, at 13:25 , PARTH MONGA wrote:<br><br>> Hi Peter<br>><br>> Can you please also update me about<br>> how to set NSEC3 narrow settings for a secured zone and how to do the same in NSEC3 inclusive mode.<br>
<br>Please read<br><a href="http://doc.powerdns.com/pdnssec.html" target="_blank" style="color:rgb(17,85,204)">http://doc.powerdns.com/pdnssec.html</a><br><a href="http://doc.powerdns.com/domainmetadata.html" target="_blank" style="color:rgb(17,85,204)">http://doc.powerdns.com/domainmetadata.html</a><br>
<br>> And as Jose said in the very first reply,Can you please confirm me that do i have to perform a key rollover if i make any changes in a secure zone or PDNS manages that part automatically.<br><br>Key rollovers are never mandatory (except when changing from NSEC to NSEC3 on a domain where DS records have already been published to the parent). PDNS does not manage key rollovers automatically, by the way.<br>
<br>Kind regards,<br>--<br>Peter van Dijk<br>Netherlabs Computer Consulting BV - <a href="http://www.netherlabs.nl/" target="_blank" style="color:rgb(17,85,204)">http://www.netherlabs.nl/</a><br><br></div><div class="HOEnZb adL" style>
<div class="adm" style="margin-top:5px;margin-right:0px;margin-bottom:5px;margin-left:0px"></div><div class="im" style="color:rgb(80,0,80)"><div class="gmail_quote">On Sat, Apr 14, 2012 at 3:30 PM, <span dir="ltr"><<a href="mailto:pdns-users-request@mailman.powerdns.com" target="_blank" style="color:rgb(17,85,204)">pdns-users-request@mailman.powerdns.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">Send Pdns-users mailing list submissions to<br>
<a href="mailto:pdns-users@mailman.powerdns.com" target="_blank" style="color:rgb(17,85,204)">pdns-users@mailman.powerdns.com</a><br><br>To subscribe or unsubscribe via the World Wide Web, visit<br> <a href="http://mailman.powerdns.com/mailman/listinfo/pdns-users" target="_blank" style="color:rgb(17,85,204)">http://mailman.powerdns.com/mailman/listinfo/pdns-users</a><br>
or, via email, send a message with subject or body 'help' to<br> <a href="mailto:pdns-users-request@mailman.powerdns.com" target="_blank" style="color:rgb(17,85,204)">pdns-users-request@mailman.powerdns.com</a><br>
<br>You can reach the person managing the list at<br> <a href="mailto:pdns-users-owner@mailman.powerdns.com" target="_blank" style="color:rgb(17,85,204)">pdns-users-owner@mailman.powerdns.com</a><br><br>When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of Pdns-users digest..."<br><br><br>Today's Topics:<br><br> 1. Re: Pdns-users Digest, Vol 111, Issue 16 (PARTH MONGA)<br> 2. Re: Pdns-users Digest, Vol 111, Issue 16 (Peter van Dijk)<br>
3. Re: Strange recursor TTL behaviour for specific host<br> (Wouter de Jong)<br> 4. Re: Strange recursor TTL behaviour for specific host<br> (Peter van Dijk)<br><br><br>----------------------------------------------------------------------<br>
<br>Message: 1<br>Date: Fri, 13 Apr 2012 16:55:10 +0530<br>From: PARTH MONGA <<a href="mailto:kprprl@gmail.com" target="_blank" style="color:rgb(17,85,204)">kprprl@gmail.com</a>><br>Subject: Re: [Pdns-users] Pdns-users Digest, Vol 111, Issue 16<br>
To: <a href="mailto:pdns-users@mailman.powerdns.com" target="_blank" style="color:rgb(17,85,204)">pdns-users@mailman.powerdns.com</a><br>Cc: <a href="mailto:peter.van.dijk@netherlabs.nl" target="_blank" style="color:rgb(17,85,204)">peter.van.dijk@netherlabs.nl</a><br>
Message-ID:<br> <CACBBYcN_nV0PMZNhH7SCQ3dcxLx2p60V2_jPm=<a href="mailto:RWtxtx%2Bakk3g@mail.gmail.com" target="_blank" style="color:rgb(17,85,204)">RWtxtx+akk3g@mail.gmail.com</a>><br>Content-Type: text/plain; charset="iso-8859-1"<br>
<br>Hi Peter<br><br>Thanks a lot for the valuable input.<br>Appreciated!!!!!!!<br>So i think am close to wrap up my installation with 9 nodes in the cluster<br>Can you please also update me about<br>how to set NSEC3 narrow settings for a secured zone and how to do the same<br>
in NSEC3 inclusive mode.<br><br>And as Jose said in the very first reply,Can you please confirm me that do<br>i have to perform a key rollover if i make any changes in a secure zone or<br>PDNS manages that part automatically.<br>
<br>Info would of great help in my setup.<br>Really appreciated your's and jose input on my queries<br><br>Thanks a lot<br><br>Best Regards<br>Parth Monga<br><br>> 2-When it is advised to roll over the keys in DNSSEC secured zones.DO i<br>
have to roll over the keys each time when i make changes to a secured zone<br>data(like changing A records or Mx Records) or it will be automatically<br>taken care by PDNS.Please elaborate this key roll over mechanism,a lot of<br>
confusion is there..<br><br>Taken from the manual:<br><br>"PowerDNS supports serving pre-signed zones, as well as online<br>('live') signed operations. In the last case, Signature Rollover and<br>Key Maintenance are fully managed by PowerDNS."<br>
<br>When you add / remove records, you need to call 'pdnssec rectify-zone<br><a href="http://example.com/" target="_blank" style="color:rgb(17,85,204)">example.com</a>' to make sure that the records orders are set properly.<br>
This is important to use NSEC, that need the record before and after<br>to give a signed denial of existence. As far I remember, the field<br>content is not use in NSEC, so you can change this at will.<br>><br><br><br>
On Fri, Apr 13, 2012 at 3:30 PM, <<a href="mailto:pdns-users-request@mailman.powerdns.com" target="_blank" style="color:rgb(17,85,204)">pdns-users-request@mailman.powerdns.com</a>>wrote:<br><br>> Send Pdns-users mailing list submissions to<br>
> <a href="mailto:pdns-users@mailman.powerdns.com" target="_blank" style="color:rgb(17,85,204)">pdns-users@mailman.powerdns.com</a><br>><br>> To subscribe or unsubscribe via the World Wide Web, visit<br>> <a href="http://mailman.powerdns.com/mailman/listinfo/pdns-users" target="_blank" style="color:rgb(17,85,204)">http://mailman.powerdns.com/mailman/listinfo/pdns-users</a><br>
> or, via email, send a message with subject or body 'help' to<br>> <a href="mailto:pdns-users-request@mailman.powerdns.com" target="_blank" style="color:rgb(17,85,204)">pdns-users-request@mailman.powerdns.com</a><br>
><br>> You can reach the person managing the list at<br>> <a href="mailto:pdns-users-owner@mailman.powerdns.com" target="_blank" style="color:rgb(17,85,204)">pdns-users-owner@mailman.powerdns.com</a><br>><br>
> When replying, please edit your Subject line so it is more specific<br>> than "Re: Contents of Pdns-users digest..."<br>><br>><br>> Today's Topics:<br>><br>> 1. Re: Huge PDNS+DNSSEC setup-Need help (Peter van Dijk)<br>
><br>><br>> ----------------------------------------------------------------------<br>><br>> Message: 1<br>> Date: Fri, 13 Apr 2012 10:58:00 +0200<br>> From: Peter van Dijk <<a href="mailto:peter.van.dijk@netherlabs.nl" target="_blank" style="color:rgb(17,85,204)">peter.van.dijk@netherlabs.nl</a>><br>
> Subject: Re: [Pdns-users] Huge PDNS+DNSSEC setup-Need help<br>> To: pdns-users Users <<a href="mailto:pdns-users@mailman.powerdns.com" target="_blank" style="color:rgb(17,85,204)">pdns-users@mailman.powerdns.com</a>><br>
> Message-ID: <<a href="mailto:883423D7-537D-472A-A01E-A7FBAF4144B7@netherlabs.nl" target="_blank" style="color:rgb(17,85,204)">883423D7-537D-472A-A01E-A7FBAF4144B7@netherlabs.nl</a>><br>> Content-Type: text/plain; charset=iso-8859-1<br>
><br>> Hi,<br>><br>> On Apr 13, 2012, at 10:37 , PARTH MONGA wrote:<br>><br>> > That for sure i will go with NSEC3 but whom to actually hit<br>> > NSEC3-inclusive or NSEC3-narrow<br>> ><br>
> > Please advice as not able to figure the difference between both NSEC3<br>> modes.<br>><br>> Benefits of narrow mode:<br>> - order name field does not matter (auth field still does)<br>> - no brute forcing calculation of names in your zones<br>
><br>> Downsides of narrow mode:<br>> - you cannot have AXFR slaves, all slaves need to be NATIVE (which would<br>> work for you)<br>><br>> Benefits of inclusive mode:<br>> - behaviour is closer to what other name servers do, easier to understand<br>
> when you get a DNSSEC expert to debug something<br>> - receives more testing than narrow<br>><br>> Kind regards,<br>> --<br>> Peter van Dijk<br>> Netherlabs Computer Consulting BV - <a href="http://www.netherlabs.nl/" target="_blank" style="color:rgb(17,85,204)">http://www.netherlabs.nl/</a><br>
><br>><br>><br>> ------------------------------<br>><br>> _______________________________________________<br>> Pdns-users mailing list<br>> <a href="mailto:Pdns-users@mailman.powerdns.com" target="_blank" style="color:rgb(17,85,204)">Pdns-users@mailman.powerdns.com</a><br>
> <a href="http://mailman.powerdns.com/mailman/listinfo/pdns-users" target="_blank" style="color:rgb(17,85,204)">http://mailman.powerdns.com/mailman/listinfo/pdns-users</a><br>><br>><br>> End of Pdns-users Digest, Vol 111, Issue 16<br>
> *******************************************<br>><br>-------------- next part --------------<br>An HTML attachment was scrubbed...<br>URL: <<a href="http://mailman.powerdns.com/pipermail/pdns-users/attachments/20120413/dcdc8ac7/attachment.html" target="_blank" style="color:rgb(17,85,204)">http://mailman.powerdns.com/pipermail/pdns-users/attachments/20120413/dcdc8ac7/attachment.html</a>><br>
<br>------------------------------<br><br>Message: 2<br>Date: Fri, 13 Apr 2012 13:30:37 +0200<br>From: Peter van Dijk <<a href="mailto:peter.van.dijk@netherlabs.nl" target="_blank" style="color:rgb(17,85,204)">peter.van.dijk@netherlabs.nl</a>><br>
Subject: Re: [Pdns-users] Pdns-users Digest, Vol 111, Issue 16<br>To: pdns-users Users <<a href="mailto:pdns-users@mailman.powerdns.com" target="_blank" style="color:rgb(17,85,204)">pdns-users@mailman.powerdns.com</a>><br>
Message-ID: <<a href="mailto:A0334D1A-2895-48D1-A60B-2E11B7C9AEC0@netherlabs.nl" target="_blank" style="color:rgb(17,85,204)">A0334D1A-2895-48D1-A60B-2E11B7C9AEC0@netherlabs.nl</a>><br>Content-Type: text/plain; charset=iso-8859-1<br>
<br>Hi,<br><br>On Apr 13, 2012, at 13:25 , PARTH MONGA wrote:<br><br>> Hi Peter<br>><br>> Can you please also update me about<br>> how to set NSEC3 narrow settings for a secured zone and how to do the same in NSEC3 inclusive mode.<br>
<br>Please read<br><a href="http://doc.powerdns.com/pdnssec.html" target="_blank" style="color:rgb(17,85,204)">http://doc.powerdns.com/pdnssec.html</a><br><a href="http://doc.powerdns.com/domainmetadata.html" target="_blank" style="color:rgb(17,85,204)">http://doc.powerdns.com/domainmetadata.html</a><br>
<br>> And as Jose said in the very first reply,Can you please confirm me that do i have to perform a key rollover if i make any changes in a secure zone or PDNS manages that part automatically.<br><br>Key rollovers are never mandatory (except when changing from NSEC to NSEC3 on a domain where DS records have already been published to the parent). PDNS does not manage key rollovers automatically, by the way.<br>
<br>Kind regards,<br>--<br>Peter van Dijk<br>Netherlabs Computer Consulting BV - <a href="http://www.netherlabs.nl/" target="_blank" style="color:rgb(17,85,204)">http://www.netherlabs.nl/</a><br><br><br><br>------------------------------<br>
<br>Message: 3<br>Date: Fri, 13 Apr 2012 17:59:08 +0200<br>From: Wouter de Jong <<a href="mailto:wouter@widexs.nl" target="_blank" style="color:rgb(17,85,204)">wouter@widexs.nl</a>><br>Subject: Re: [Pdns-users] Strange recursor TTL behaviour for specific<br>
host<br>To: pdns-users Users <<a href="mailto:pdns-users@mailman.powerdns.com" target="_blank" style="color:rgb(17,85,204)">pdns-users@mailman.powerdns.com</a>><br>Message-ID: <<a href="mailto:20120413155907.GA57124@widexs.nl" target="_blank" style="color:rgb(17,85,204)">20120413155907.GA57124@widexs.nl</a>><br>
Content-Type: text/plain; charset=us-ascii<br><br>Hi Peter,<br><br>On Thu, Apr 12, 2012 at 08:09:01PM +0200, Peter van Dijk wrote:<br><br>> > As you can see, TTL 37 -> 34 -> 30 -> 27 -> 24 -> 32<br>> ><br>
> > I'm wondering what could be causing this ?<br>><br>> Try threads=1 in recursor.conf. If that causes it, there is no need for alarm :)<br><br>Great, that seems to explain it indeed :)<br><br>Apparently, default threads= setting > 1 ?<br>
<br>Best regards,<br><br>Wouter<br><br><br>------------------------------<br><br>Message: 4<br>Date: Sat, 14 Apr 2012 11:10:39 +0200<br>From: Peter van Dijk <<a href="mailto:peter.van.dijk@netherlabs.nl" target="_blank" style="color:rgb(17,85,204)">peter.van.dijk@netherlabs.nl</a>><br>
Subject: Re: [Pdns-users] Strange recursor TTL behaviour for specific<br> host<br>To: pdns-users Users <<a href="mailto:pdns-users@mailman.powerdns.com" target="_blank" style="color:rgb(17,85,204)">pdns-users@mailman.powerdns.com</a>><br>
Message-ID: <<a href="mailto:A7CBB02F-94E3-44F8-8C76-780F06C77693@netherlabs.nl" target="_blank" style="color:rgb(17,85,204)">A7CBB02F-94E3-44F8-8C76-780F06C77693@netherlabs.nl</a>><br>Content-Type: text/plain; charset=us-ascii<br>
<br>Hi Wouter,<br><br>On Apr 13, 2012, at 17:59 , Wouter de Jong wrote:<br><br>> Apparently, default threads= setting > 1 ?<br><br><br>Yes - see 'pdns_recursor --config' for all defaults.<br><br>Kind regards,<br>
--<br>Peter van Dijk<br>Netherlabs Computer Consulting BV - <a href="http://www.netherlabs.nl/" target="_blank" style="color:rgb(17,85,204)">http://www.netherlabs.nl/</a><br><br><br><br>------------------------------<br><br>
_______________________________________________<br>Pdns-users mailing list<br><a href="mailto:Pdns-users@mailman.powerdns.com" target="_blank" style="color:rgb(17,85,204)">Pdns-users@mailman.powerdns.com</a><br><a href="http://mailman.powerdns.com/mailman/listinfo/pdns-users" target="_blank" style="color:rgb(17,85,204)">http://mailman.powerdns.com/mailman/listinfo/pdns-users</a><br>
<br><br>End of Pdns-users Digest, Vol 111, Issue 17<br>*******************************************</blockquote></div></div></div>