<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=us-ascii" http-equiv=Content-Type>
<STYLE>
BLOCKQUOTE {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px; MARGIN-LEFT: 2em
}
OL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
UL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
P {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
BODY {
LINE-HEIGHT: 1.5; FONT-FAMILY: 宋体; COLOR: #000000; FONT-SIZE: 10.5pt
}
</STYLE>
<META name=GENERATOR content="MSHTML 8.00.6001.18702"></HEAD>
<BODY style="MARGIN: 10px">
<DIV>
<DIV>Hi Matthijs,</DIV>
<DIV> </DIV>
<DIV>I'm now using Adapter File which is more stable than Adapter DNS.</DIV>
<DIV>The work flow is as follows:</DIV>
<DIV>1.generate zone files from db and saved in ./unsigned/</DIV>
<DIV>2.when all the zone files are ready, run ods-signer sign --all</DIV>
<DIV>3.monitor whether there are signed zones in ./signed/ and scp immediately
signed </DIV>
<DIV>zone from ./signed to hidden master BIND , after transfer completeed using
"rndc reload"</DIV>
<DIV>to make BIND reload the newly signed zone file</DIV>
<DIV>4.test whether </DIV>
<DIV>4.do the above steps every 15 mins</DIV>
<DIV> </DIV>
<DIV>The problem is sometimes the zone files in the ./singed/ may be not signed
by ods-signer </DIV>
<DIV>sign --all, it may be signed by automatic resign, so sometimes the RRs in
the zones are</DIV>
<DIV>not the exact ones in db. So as you suggested, I have changed the resign
value to a relatively</DIV>
<DIV>large number but I find that I have to changed refresh,
validity/default,validity/denial, too,</DIV>
<DIV>so I can not set the resign period to 1Y for example, because refresh
should be larger than resign</DIV>
<DIV>and validity/default and validity/denial should be larger than refresh. I
think the validity is 30D</DIV>
<DIV>which is commonly used by registries, so can you recommend other
values?</DIV>
<DIV> </DIV>
<DIV>And I knew that if a zone is not signed compeltely, ods-signerd will
only create a <zone>.tmp file in</DIV>
<DIV>./signed/, but in my test I have found that a zone has been scped to the
hidden master with less size</DIV>
<DIV>than its supposed size, and its file name is test not test.tmp, so my
program is sure that it's signed completely</DIV>
<DIV>and transfer it to the destination. Is there a possibility that ods-signerd
signs zone file not completely and</DIV>
<DIV>make <zone>.tmp to <zone>? If not, I can hardly understand why
the signed file is more less than the unsigned one.</DIV></DIV>
<DIV> </DIV>
<DIV>Best regards,</DIV>
<DIV>Stuart</DIV></BODY></HTML>