<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=us-ascii" http-equiv=Content-Type>
<STYLE>
BLOCKQUOTE {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px; MARGIN-LEFT: 2em
}
OL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
UL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
P {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
BODY {
LINE-HEIGHT: 1.5; FONT-FAMILY: 宋体; COLOR: #000000; FONT-SIZE: 10.5pt
}
</STYLE>
<META name=GENERATOR content="MSHTML 8.00.6001.18702"></HEAD>
<BODY style="MARGIN: 10px">
<DIV>Hi All,</DIV>
<DIV> </DIV>
<DIV>As I posted earlier, the 'RR Does Not Exist' and ods-signer would not signs
RRSIGs until it expires cause a lot of problems.</DIV>
<DIV>My test tlds here have their KSK rollovered every 4H and ZSK rollovered
every 2H, and after days of test you can see the amount of DNSKEYS</DIV>
<DIV>exist in the zone file and most of which are dead.</DIV>
<DIV> </DIV>
<DIV>
<DIV>[gtld@index zone]$ dig @202.173.9.4 dstest1 dnskey +edns=0|grep DNSKEY|wc -l</DIV>
<DIV>75</DIV>
<DIV>[gtld@index zone]$ dig @202.173.9.4 dstest2 dnskey +edns=0|grep DNSKEY|wc -l</DIV>
<DIV>67</DIV>
<DIV> </DIV>
<DIV>It's obvious opendnssec did not remove them in the zone, I will change the
<purge> to 1H which was 14D by default, I hope this will help.</DIV>
<DIV> </DIV>
<DIV>I wrote a script to do nsupdate soa to the INBOUND bind and this can make
opendnssec resign the expiring RRs,or the RRSIGs will keep expired, but it can
not solve the Lots-of-Dead-DNSKEYs problem.</DIV>
<DIV> </DIV>
<DIV>I need your help guys.</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>Best regards,</DIV>
<DIV>Stuart</DIV></DIV></BODY></HTML>