2 ms·

> But in theory, you shouldn't need to update your DS records much more often than you update your NS records Maybe? You'd update DS whenever changing your key

by jcgl 7mo ago

> But in theory, you shouldn't need to update your DS records much more often than you update your NS records Maybe? You'd update DS whenever changing your key-signing keys. You'd update your NS records and/or glue records when changing your nameservers and/or their IP addresses respectively. In a parallel world with high DNSSEC adoption and well-oiled key management solutions, you're probably making DS changes far more often than NS changes. NS changes might never even happen after a domain's initial setup.

gucci-on-fleek 7mo ago
> Maybe? You'd update DS whenever changing your key-signing keys. Sure, but if once every ~8 years is good enough for the root zone [0], then surely it's good enough for everyone :). I guess I was mainly thinking of my own setup with a single static key but with glue records that I need to change semi-regularly, but this isn't really a typical setup at all. > In a parallel world with high DNSSEC adoption and well-oiled key management solutions, you're probably making DS changes far more often than NS changes. Yup, agreed. [0]: https://data.iana.org/root-anchors/root-anchors.xml https://data.iana.org/root-anchors/root-anchors.xml
- jcgl 7mo ago
  > Sure, but if once every ~8 years is good enough for the root zone [0], then surely it's good enough for everyone :) Yeah, I don't know how to feel about that exactly :) like, is it actually good enough for them? Probably, I suppose. Those keys don't need to be used that often, and all the signing can be done offline. Contrast that with places further down the hierarchy where stuff changes much more rapidly. And if you're doing something reasonably dynamic (e.g. [0]) then you're gonna need or want online keys. Which (presumably?) should be rotated more frequently because they're more exposed. [0] https://doc.powerdns.com/authoritative/lua-records/index.html#details-security https://doc.powerdns.com/authoritative/lua-records/index.htm...

by jcgl 7mo ago

gucci-on-fleek 7mo ago

> Maybe? You'd update DS whenever changing your key-signing keys. Sure, but if once every ~8 years is good enough for the root zone [0], then surely it's good enough for everyone :). I guess I was mainly thinking of my own setup with a single static key but with glue records that I need to change semi-regularly, but this isn't really a typical setup at all. > In a parallel world with high DNSSEC adoption and well-oiled key management solutions, you're probably making DS changes far more often than NS changes. Yup, agreed. [0]: https://data.iana.org/root-anchors/root-anchors.xml https://data.iana.org/root-anchors/root-anchors.xml

jcgl 7mo ago
> Sure, but if once every ~8 years is good enough for the root zone [0], then surely it's good enough for everyone :) Yeah, I don't know how to feel about that exactly :) like, is it actually good enough for them? Probably, I suppose. Those keys don't need to be used that often, and all the signing can be done offline. Contrast that with places further down the hierarchy where stuff changes much more rapidly. And if you're doing something reasonably dynamic (e.g. [0]) then you're gonna need or want online keys. Which (presumably?) should be rotated more frequently because they're more exposed. [0] https://doc.powerdns.com/authoritative/lua-records/index.html#details-security https://doc.powerdns.com/authoritative/lua-records/index.htm...