Hi Andreas, have you read the documentation? https://www.knot-dns.cz/docs/2.9/singlehtml/index.html#dnssec-key-rollovers If something curical is missing there, we might want to update it. Please tell us after you do your experiments ;) Libor Dne 11.01.20 v 13:15 A. Schulze napsal(a):

Hello Andreas, Please note that Jan-Piet commented the DS-push feature, which is mostly used for subzone's KSK rollover. If you want to synchronize a zone's DS record with the TLD (.de for example), it's a different story as it depends on the parent zone capabilities. Also take a look at his blog post https://jpmens.net/2019/11/13/an-authoritative-knot/ Best, Daniel On 2020-01-11 13:15, A. Schulze wrote: