[Opendnssec-user] [EXT] TTL values through to signed zone?

Jake Zack jake.zack at cira.ca
Tue Dec 3 20:05:23 UTC 2019

In /etc/opendnssec/kasp.xml, do you have a...


...inside your <zone> </zone> context?

If not, perhaps it's a default that occurs in the absence of a TTL specified there.

(Random list observer, not affiliated with opendnssec/nlnetlabs)

-----Original Message-----
From: Opendnssec-user <opendnssec-user-bounces at lists.opendnssec.org> On Behalf Of Havard Eidnes
Sent: December 3, 2019 2:54 PM
To: opendnssec-user at lists.opendnssec.org
Subject: [EXT] [Opendnssec-user] TTL values through to signed zone?


with OpenDNSSEC 1.4.14, with zone transfers in + out, we've tried to publish an RRset with a relatively short TTL:

% dig @<hidden-master> vpn.eduvpn.uninett.no. a ...
vpn.eduvpn.uninett.no.  600     IN      A
vpn.eduvpn.uninett.no.  600     IN      A

However, when these records have passed through OpenDNSSEC, this gets transformed into

vpn.eduvpn.uninett.no.  86400   IN      A
vpn.eduvpn.uninett.no.  86400   IN      A
vpn.eduvpn.uninett.no.  86400   IN      RRSIG   A 8 4 86400 20191222101620 20191130232045 44016 eduvpn.uninett.no. WLeTApQJso6WTaQgOvDZgD+Gjfrp/54I/cmre4/po2DdzfmrsLRn4Ujh 4kodfMoRw2BZkaVCXb3IFWMm/dbkKh/FF0WYMXdHd1qheXbOlO94DMLw mtgApQ3UQ7JMx/dkp2mCXlHAohIhPl4hh2bPh2y6g9cT1+SK3IhtU+IY Wzx9GLGlNUf96OwYkKNix1Nwq2GyUZ1FQMhIAncwhkPqiA==

Why doesn't the lowered TTL survive intact in its passage through OpenDNSSEC?  Bug?


- Håvard
Opendnssec-user mailing list
Opendnssec-user at lists.opendnssec.org

More information about the Opendnssec-user mailing list