Hi Peter,
On 20/07/2026 21:30, Peter Thomassen wrote:
"While performing this procedure to recover from an unusable ZSK or
CSK the SOA record of the zone cannot be changed. This is because at
the moment the new DNSKEY gets introduced into the zone, the _SOA_
RRset cannot be signed with the old, unusable key."
I guess that depends on whether the replication mechanism used for the
zone relies on SOA record changes at all.
Correct.
The draft currently says "To ensure the zone is still propagated, any
secondary name servers _relying on IXFR/AXFR_ need to be manually forced
to load the new version of the zone.". Is that clear enough or should we
word it more broadly?
Kind regards,
Martin
_______________________________________________
DNSOP mailing list -- [email protected]
To unsubscribe send an email to [email protected]
