Hi Libor, > > AFAIK using multiple parallel signers is an unexplored territory in DNS. > > It's not difficult to ensure matching SOA serials, but having different > zone versions with same SOA serial is only asking for more trouble: what > if any secondary takes (for whatever reason) an IXFR from the other > signer than previously... > > There is a way to sign zone deterministicly (either RSA or Deterministic > ECDSA), but whole DNSSEC relies on unix timestamp, and it seems not > viable to establish a second-precision sync among signers. There have > been thoughts about this previously, but none went far enough to be > adopted by Knot. > > I agree it would be useful to have parallel signers, for the sake of > reliability, even better if they were of very different implementations. > But I haven't heard of any functioning setup. I assume most operators > simply rely on a single signer, while they are able to fix any issues > before the zone expires on public secondaries. >
Our plan is to have basically a warm standby. It will have a backup of the keys and the same zone data, but it will not send notifies and will not accept XFR. A promotion script will turn on notifies and permit XFR. The benefit of keeping it warm is that we'll be able to monitor it and fix any problems with signing if and when they arise. We'd rather not discover it and have to deal with it when the active signer has failed. > BR, > > Libor > > PS: it's both odd and inspiring how different TLD operators face > different issues and focus on different goals: .de strikes frequency of > updates, .be triple-checks that the zone was not signed incorrectly, .is > seeks assurance that the signer keeps running ... :) > .be triple checks after they were hit with https://www.dnsbelgium.be/en/news/nsec3-issue-15112018 :) OpenDNSSEC has served us well these last years, but knot is a much better fit for us. The new online backup/restore makes syncing keys super easy and the config is very ansible friendly, something that opendnssec does not have. .einar -- https://lists.nic.cz/mailman/listinfo/knot-dns-users
