On 28/09/2018 10:55, Anand Buddhdev wrote: > On 11 October, the old key won't be removed. On that day, the new key > will start signing the DNSKEY RRset. The old key (id 19036), will remain > in the root zone; it just won't sign the DNSKEY RRset. Eventually, in > the first quarter of 2019, it will be revoked, and then removed *after* > the hold-down period.
My apologies to the list, Anand is correct! I had misremembered which phase of the roll we were in, getting confused by just how long KSK2017 has already been in the root zone for. The guidance in our KB articles still stands, though. :) kind regards, Ray _______________________________________________ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users