[dns-operations] .fr has 5 DNSKEYs

[Paul Wouters]

On Tue, 31 May 2011, Stephane Bortzmeyer wrote:

> Pre-publishing the ZSK solves this problem.

I did not mean to say don't prepublish a new ZSK key. But you only need
to do that when you're doing a ZSK rollover. Add the ZSK and wait at least
TTL RRset(DNSKEY). So in your case, you only need just over 2 days with a
double ZSK. Though in your system there is now also a time when there are
3 ZSKs.

I guess you can play safe and prepublish the new ZSK all the time, though
personally I would expect more outages based on dns packet sizes for the
DNSKEY set, then from needing to do an emergency ZSK rollover.

Paul