<html><head><meta http-equiv="content-type" content="text/html; charset=us-ascii"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><meta http-equiv="content-type" content="text/html; charset=us-ascii"><div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hi Xan,<div><br></div><div>It depends which DNSSEC you choose. If you would pick "Online Signing" for instance (great unless you have very busy servers with lots of domains), the "keying data" is stored in the database as well, so both servers would use the same data to sign the zone, resulting in consistent signatures (as long as your MariaDB replication isn't broken).</div><div><br></div><div>See <a href="https://doc.powerdns.com/authoritative/dnssec/modes-of-operation.html#online-signing">https://doc.powerdns.com/authoritative/dnssec/modes-of-operation.html#online-signing</a> for more info and other ways of turning on DNSSEC on PowerDNS.</div><div><br></div><div>Frank</div><div><br><div><br><div>
<div><meta charset="UTF-8"><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div>Frank Louwers<br>PowerDNS Certified Consultant @ Kiwazo.be</div></div></div>
</div>
<div><br><blockquote type="cite"><div>On 21 Aug 2023, at 17:03, Xan Charbonnet via Pdns-users <pdns-users@mailman.powerdns.com> wrote:</div><br class="Apple-interchange-newline"><div><div>Hello everyone,<br><br>We've been successfully using PowerDNS for some time, and are looking into enabling DNSSEC.<br><br>If two PowerDNS authoritative servers are set up for native replication, sharing a single MariaDB backend where the database is replicated using MariaDB's replication, how would DNSSEC be enabled? If I just turn it on, wouldn't the two servers step on each other's toes when it came time to do a key rollover? Or is that not a problem?<br><br>Thanks in advance.<br>_______________________________________________<br>Pdns-users mailing list<br>Pdns-users@mailman.powerdns.com<br>https://mailman.powerdns.com/mailman/listinfo/pdns-users<br></div></div></blockquote></div><br></div></div></div></body></html>