On Wed, Jul 01, 2026 at 01:11:06PM +0200, Patrick Ben Koetter via mailop wrote:
> Migration to a new DNS platform has successfully been completed and the domain
> is DNSSEC-secured again:
>
> $ dig +dnssec NS mailop.org +short
> ns1.desec.io.
> ns2.desec.org.
> NS 13 2 3600 20260709000000 20260618000000 10640 mailop.org.
> K65k7I/AQFIXyjn1wVCaW481ojKiNPcjhwqAgGvJL9GkA6RxEmQP083m
> RVwYZ3C4rCEH21oqGByxtDgoPCQHjA==
>
> $ dig +dnssec DSKEY mailop.org +short
> 91.132.147.157
> A 13 2 3600 20260709000000 20260618000000 10640 mailop.org.
> LuvKPNqTIckcTW/VQRCB8BAjwUDujhR/MspKOX1M+TdKirmpUZ/F/apR
> UjLAPpBDU3MnWaL4jmqonc9C+zW+Dw==
TL;DR, all good, though perhaps you meant "dnskey" rather than
"dskey"... Also, rather than "+short", I think "+nocrypto" and
"+nottl" are typically more useful in this context. With my
private "hsdig" CLI doing the work in parallel (so reported in
order of received replies):
$ for t in {,c}ds {,c}dnskey soa ns mx; do printf "%s mailop.org\n" $t;
done | hsdig --nocrypto -D
; NOERROR qr rd ra ad do
mailop.org. IN DNSKEY 257 3 13 [key id = 10640]
mailop.org. IN RRSIG DNSKEY 13 2 3600 20260709000000 20260618000000 10640
mailop.org. [omitted]
; NOERROR qr rd ra ad do
mailop.org. IN CDS 10640 13 2 [omitted]
mailop.org. IN CDS 10640 13 4 [omitted]
mailop.org. IN RRSIG CDS 13 2 3600 20260709000000 20260618000000 10640
mailop.org. [omitted]
; NOERROR qr rd ra ad do
mailop.org. IN CDNSKEY 257 3 13 [key id = 10640]
mailop.org. IN RRSIG CDNSKEY 13 2 3600 20260709000000 20260618000000 10640
mailop.org. [omitted]
; NOERROR qr rd ra ad do
mailop.org. IN DS 10640 13 2 [omitted]
mailop.org. IN RRSIG DS 8 2 3600 20260722080321 20260701070321 22809 org.
[omitted]
; NOERROR qr rd ra ad do
mailop.org. IN NS ns1.desec.io.
mailop.org. IN NS ns2.desec.org.
mailop.org. IN RRSIG NS 13 2 3600 20260709000000 20260618000000 10640
mailop.org. [omitted]
; NOERROR qr rd ra ad do
mailop.org. IN SOA get.desec.io. get.desec.io. 2026065948 86400 3600
2419200 3600
mailop.org. IN RRSIG SOA 13 2 300 20260709000000 20260618000000 10640
mailop.org. [omitted]
; NOERROR qr rd ra ad do
mailop.org. IN MX 5 mx.mailop.org.
mailop.org. IN RRSIG MX 13 2 3600 20260709000000 20260618000000 10640
mailop.org. [omitted]
I see validated results for the core zone apex record types as well as
the DS RRset at the parent, with the CSK (KSK+ZSK) key id consistently
reported as 10640. Personally, I wouldn't have bothered with CDS hash
type 4 (SHA2-384):
https://www.iana.org/assignments/ds-rr-types/ds-rr-types.xhtml
But it is of course at least harmless, whether or not useful.
--
Viktor. 🇺🇦 Слава Україні!
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
