<html><head></head><body><div class="yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:10px;"><div dir="ltr" data-setdir="false"><div>When I last looked at DNSSEC I was using ISC Bind 9.11.1<br><br>The dnssec-signzone command produced the expected<br><br> dsset-zonename<br><br>File with two entries e.g.<br> <br> example.com. IN DS 16293 7 1 173543F8153BBCDF9B7A0E127A1E76A10A489748<br> example.com. IN DS 16293 7 2 01F3E27E9DE840A99D81DE9BA26272FDEB9F1C40AA0CB8FACF31A5CA 56742F94<br><br>Signing the same zone file now using ISC Bind 9.16.5 I see only one entry e.g.<br><br> example.com. IN DS 63741 7 2 DA0B7F5FB60F1FC49A35C8DEC5CDD47185A9CAB5371C0C42B249F4B5 900E11BC<br><br>I note that providers such as Cloudfare / ClouDNS still give examples requiring two entries as per the 9.11.1 output.<br><br>Question:<br><br>Should my DSSET File using the current version of ISC Bind contain One or Two entries?<br><br><br><br><br></div><div><br></div></div></div></body></html>