search for: dnsviz

...ns a start and expiration time for the records. > > If you upload signed zone files to godaddy, make sure to resign once a > week or so so that the RRSIG gets updated. > > man ldns-signzone Okay so I misunderstood the message I was getting when I checked my DNSSEC setup via http://dnsviz.net/. What you are telling me is that all I had to do was re-sign the zone files but that it was not necessary to generate new keys. This point is definitely one that I missed. I too run my own authoritative nameservers. I was following the Digital Ocean procedure to setup DNSSEC: https://www....

...the records. >> >> If you upload signed zone files to godaddy, make sure to resign once a >> week or so so that the RRSIG gets updated. >> >> man ldns-signzone > > Okay so I misunderstood the message I was getting when I checked my > DNSSEC setup via http://dnsviz.net/. What you are telling me is that all > I had to do was re-sign the zone files but that it was not necessary to > generate new keys. This point is definitely one that I missed. > > I too run my own authoritative nameservers. I was following the Digital > Ocean procedure to se...

Last weekend I had my DNSSEC keys expire. I discovered that they had expired the hard way... namely randomly websites could not be found and email did not get delivered. It seems that the keys were only valid for what I estimate was about 30 days. It is a real PITA to have update the keys, restart named and then update Godaddy with new digests. The first part of the problem is fairly