[dns-operations] Signatures expired in 54.in-addr.arpa
cet1 at cam.ac.uk
Sat Apr 20 20:07:32 UTC 2013
On Apr 20 2013, I wrote:
>The RRSIG records in 54.in-addr.arpa have expired, at 2013-04-19 00:00:30 UTC.
>http://dnssec-debugger.verisignlabs.com/54.in-addr.arpa confirms this.
>dns-ops at arin.net (SOA.rname for the zone) cc'd.
>This particular zone seems to have a jinx on it - it was the one for
>which the DS and DNSKEY records got out of step in December 2011.
A more detailed inspection suggests that the zone had never been updated
at all since the start of the 10-day validity period of the RRSIGs.
I got a really rapid reply from Pete Toscano at ARIN, and there's now a
new version, generated today, on the ARIN nameservers. Unfortunately, this
one has a mismatch between the DNSKEY records and the DS in the parent
zone - i.e. we are back in the December 2011 scenario.
Jinxed, indeed... :-(
Chris Thompson University of Cambridge Computing Service,
Email: cet1 at ucs.cam.ac.uk New Museums Site, Cambridge CB2 3QH,
Phone: +44 1223 334715 United Kingdom.
More information about the dns-operations