Migrating to a New Cryptographic Suite

Hi, I am running a test about the DNSSEC on my name servers. At present, i use the algorithm RSASHA-1 for DNSKEY, but i want migrate the RSASHA-1 to RSASHA-256, when i resigning the zone,it failed. so i wonder if DNSSEC supporting migrating RSASHA-1 to RSASHA-256 smoothly?

update failed: SERVFAIL

Hi, I have a problem about the DDNS ,When I nsupdated the master dns server under with dnssec,but it failed as following: *r...@root:/var/named/chroot/etc# nsupdate -d server 192.168.225.130 5353 update add test.net 900 A 5.5.5.5 Reply from SOA query: ;; -HEADER- opcode: QUERY, status:

Signing with the KSK and ZSK

Hi folks, i have a question about signing zone files with the ksk and the zsk, as i know,when signing the zone files i have to use the ksk and zsk both,just as following: *dnssec-signzone -o domain-name -t -k KSK zone-name ZSK* but i want to sign the ZSK with KSK first,and then sign the zone