> Sure, but if once every ~8 years is good enough for the root zone [0], then surely it's good enough for everyone :) Yeah, I don't know how to feel about that

> Sure, but if once every ~8 years is good enough for the root zone [0], then surely it's good enough for everyone :) Yeah, I don't know how to feel about that exactly :) like, is it actually good enough for them? Probably, I suppose. Those keys don't need to be used that often, and all the signing can be done offline. Contrast that with places further down the hierarchy where stuff changes much more rapidly. And if you're doing something reasonably dynamic (e.g. [0]) then you're gonna need or want online keys. Which (presumably?) should be rotated more frequently because they're more exposed. [0] https://doc.powerdns.com/authoritative/lua-records/index.html#details-security https://doc.powerdns.com/authoritative/lua-records/index.htm...