[dns-operations] .ie Algorithm rollover nit?

Viktor Dukhovni ietf-dane at dukhovni.org
Sun Nov 29 22:29:17 UTC 2020

On Sun, Nov 29, 2020 at 05:19:14PM -0500, Olafur Gudmundsson wrote:

> As this is going to be an Async operation this is the ONLY right order of execution. 

Note, that at the time I observed the issue, the order was wrong:


Algorithm 8 *was* present in the DS RRset, and was absent from the

> As presence of an algorithm in DS set is a “contract” that the zone is
> signed by that algorithm, now that 8 has been removed from the DS set
> it can next be removed from the DNSKEY set and then the RRSIG’s can be
> deleted. 

This got remediated some time later, and now the order is correct.


More information about the dns-operations mailing list