<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Azur,<div class=""><br class=""></div><div class="">Ha, indeed, it seems they did…</div><div class=""><br class=""></div><div class="">Best practise would still be to have a 1:1 relationship between a keyset and a domain, so create a new keyset for every dnssec-domain.</div><div class=""><br class=""></div><div class="">If you do want to reuse your dnssec keys, you have a few options:</div><div class=""><br class=""></div><div class="">- fiddle with the custom query options in pdns.conf to return “the correct record” for a domain, maybe based on a view in the db?</div><div class=""><br class=""></div><div class="">- keep the “golden” cryptokey you want to use somewhere in your code, and use the API or the DB to insert that particular key as the domain’s cryptokey. Disadvantage: whenever you want to change the key, you’d have to update all the cryptokey records</div><div class=""><br class=""></div><div class="">- rethink everything, go the recommended route and use a different DS/KEYSET for every domain (which means creating a new KEYSET for every domain)</div><div class=""><br class=""></div><div class="">Kind Regards,</div><div class=""><br class=""></div><div class=""><span style="font-family: AvenirNext-Regular;" class="">Frank Louwers</span><br style="font-family: AvenirNext-Regular;" class=""><span style="font-family: AvenirNext-Regular;" class="">Certified PowerDNS Consultant @ </span><a href="http://Kiwazo.be" style="font-family: AvenirNext-Regular;" class="">Kiwazo.be</a></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""><div class=""><br class=""></div><div class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 20 May 2019, at 10:41, <a href="mailto:azurit@pobox.sk" class="">azurit@pobox.sk</a> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Hi Frank,<br class=""><br class="">it's mandatory for .CZ domains, so if you don't sign every domain with the same key, you need to register a KEYSET for every domain. So this is what i'm trying to solve.<br class=""><br class=""><br class=""><br class=""><br class=""><br class="">Citát frank+pdns--- via Pdns-users <<a href="mailto:pdns-users@mailman.powerdns.com" class="">pdns-users@mailman.powerdns.com</a>>:<br class=""><br class=""><blockquote type="cite" class="">Hi Azur,<br class=""><br class="">It’s possible to do so, by manipulating the database directly (see the cryptokeys table).<br class=""><br class="">However, let’s take a step back: what problem are you trying to solve? As far as I know, there’s not a single TLD where the use of KEYSETs is mandatory. Some offer it as an extra feature, but I am not aware of any TLD where this would be mandatory.<br class=""><br class="">Kind Regards,<br class=""><br class="">Frank Louwers<br class="">Certified PowerDNS Consultant @ <a href="http://Kiwazo.be" class="">Kiwazo.be</a><br class="">_______________________________________________<br class="">Pdns-users mailing list<br class=""><a href="mailto:Pdns-users@mailman.powerdns.com" class="">Pdns-users@mailman.powerdns.com</a><br class=""><a href="https://mailman.powerdns.com/mailman/listinfo/pdns-users" class="">https://mailman.powerdns.com/mailman/listinfo/pdns-users</a><br class=""></blockquote><br class=""><br class=""><br class="">_______________________________________________<br class="">Pdns-users mailing list<br class=""><a href="mailto:Pdns-users@mailman.powerdns.com" class="">Pdns-users@mailman.powerdns.com</a><br class=""><a href="https://mailman.powerdns.com/mailman/listinfo/pdns-users" class="">https://mailman.powerdns.com/mailman/listinfo/pdns-users</a><br class=""></div></div></blockquote></div><br class=""></div></div><div class=""></div></body></html>