3 ms·

> Maybe? You'd update DS whenever changing your key-signing keys. Sure, but if once every ~8 years is good enough for the root zone [0], then surely it's good

> Maybe? You'd update DS whenever changing your key-signing keys. Sure, but if once every ~8 years is good enough for the root zone [0], then surely it's good enough for everyone :). I guess I was mainly thinking of my own setup with a single static key but with glue records that I need to change semi-regularly, but this isn't really a typical setup at all. > In a parallel world with high DNSSEC adoption and well-oiled key management solutions, you're probably making DS changes far more often than NS changes. Yup, agreed. [0]: https://data.iana.org/root-anchors/root-anchors.xml https://data.iana.org/root-anchors/root-anchors.xml

jcgl 7mo ago
> Sure, but if once every ~8 years is good enough for the root zone [0], then surely it's good enough for everyone :) Yeah, I don't know how to feel about that exactly :) like, is it actually good enough for them? Probably, I suppose. Those keys don't need to be used that often, and all the signing can be done offline. Contrast that with places further down the hierarchy where stuff changes much more rapidly. And if you're doing something reasonably dynamic (e.g. [0]) then you're gonna need or want online keys. Which (presumably?) should be rotated more frequently because they're more exposed. [0] https://doc.powerdns.com/authoritative/lua-records/index.html#details-security https://doc.powerdns.com/authoritative/lua-records/index.htm...