<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On 17-Jun-09, at 8:28 PM, Mark Andrews wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div><br>In message <<a href="mailto:E807EEC1-6B38-40D9-9D13-8C9EF9B0E3CA@ca.afilias.info">E807EEC1-6B38-40D9-9D13-8C9EF9B0E3CA@ca.afilias.info</a>>, Dave Knight <br>writes:<br><blockquote type="cite">Hi George,<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">On 17-Jun-09, at 11:25 AM, George Barwood wrote:<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><blockquote type="cite">dig dnskey +dnssec @a0.org.afilias-nst.info +norecurse<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">seems to be is showing zero TTL for the Dnskey records.<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">Am I confused or missing something, isn't this all wrong?<br></blockquote></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">You are correct, this is a problem and we are aware of it.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Our DNSSEC signer appliance takes the TTL for the DNSKEY records and <br></blockquote><blockquote type="cite">their signatures from the TTL of the SOA. Until this weekend ORGs SOA <br></blockquote><blockquote type="cite">TTL was 0, it has now been changed to 900. We will do a followup <br></blockquote><blockquote type="cite">maintenance soon to correct the DNSKEY TTLs. I'll follow-up to the <br></blockquote><blockquote type="cite">list when that happens.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Thanks for your attention.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">dave<br></blockquote><blockquote type="cite">Afilias<br></blockquote><br><span class="Apple-tab-span" style="white-space:pre"> </span>Do you have packet traces similar to the ones in<br><span class="Apple-tab-span" style="white-space:pre"> </span>wessels_light_N46.pdf?</div></blockquote><div><br></div><div>We do, happy to make them available to OARC too.</div><div><br></div><br><blockquote type="cite"><div><span class="Apple-tab-span" style="white-space:pre"> </span>Why still a low a ttl for DNSKEY? I can understand for<br><span class="Apple-tab-span" style="white-space:pre"> </span>negative responses but changes to DNSKEY would have to be<br><span class="Apple-tab-span" style="white-space:pre"> </span>on the order of days anyway as that is what it takes to<br><span class="Apple-tab-span" style="white-space:pre"> </span>change trust anchors.<br></div></blockquote></div><br><div><div>Our signer solution doesn't currently allow the TTL of these records to be set individually, a fix for this is in the pipeline though.</div><div><br></div><div><br></div><div>dave</div><div>Afilias</div></div></body></html>