7 Pro
2018
7 Pro
'18
11:50
Hi all,
one of my zones made a ZSK rollover yesterday. I had an some recursive
resolvers validation errors at different times. This is the log output
from knot of the rollover:
Dec 6 17:16:48 a knotd[9924]: info: [voja.de.] DNSSEC, signing zone
Dec 6 17:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, ZSK rollover
started
Dec 6 17:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, key, tag 53800,
algorithm RSASHA256, KSK, public, ready, active
Dec 6 17:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, key, tag 15820,
algorithm RSASHA256, public
Dec 6 17:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, key, tag 38188,
algorithm RSASHA256, public, active
Dec 6 17:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, signing started
Dec 6 17:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, successfully
signed
Dec 6 17:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, next signing at
2018-12-06T18:16:49
Dec 6 17:16:49 a knotd[9924]: info: [voja.de.] zone file updated,
serial 1543943808 -> 1544113009
Dec 6 17:16:50 a knotd[9924]: info: [voja.de.] notify, outgoing,
10.10.10.10@53: serial 1544113009
Dec 6 17:16:50 a knotd[9924]: info: [voja.de.] IXFR, outgoing,
10.10.10.10@45727: started, serial 1543943808 -> 1544113009
Dec 6 17:16:50 a knotd[9924]: info: [voja.de.] IXFR, outgoing,
10.10.10.10@45727: finished, 0.00 seconds, 1 messages, 1329 bytes
Dec 6 18:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, signing zone
Dec 6 18:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, key, tag 53800,
algorithm RSASHA256, KSK, public, ready, active
Dec 6 18:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, key, tag 38188,
algorithm RSASHA256, public
Dec 6 18:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, key, tag 15820,
algorithm RSASHA256, public, active
Dec 6 18:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, signing started
Dec 6 18:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, successfully
signed
Dec 6 18:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, next signing at
2018-12-06T19:16:49
Dec 6 18:16:49 a knotd[9924]: info: [voja.de.] zone file updated,
serial 1544113009 -> 1544116609
Dec 6 18:16:49 a knotd[9924]: info: [voja.de.] notify, outgoing,
10.10.10.10@53: serial 1544116609
Dec 6 18:16:49 a knotd[9924]: info: [voja.de.] IXFR, outgoing,
10.10.10.10@53131: started, serial 1544113009 -> 1544116609
Dec 6 18:16:49 a knotd[9924]: info: [voja.de.] IXFR, outgoing,
10.10.10.10@53131: finished, 0.00 seconds, 1 messages, 43889 bytes
Dec 6 18:16:50 a knotd[9924]: info: [voja.de.] AXFR, outgoing,
10.10.10.10@59417: started, serial 1544116609
Dec 6 18:16:50 a knotd[9924]: info: [voja.de.] AXFR, outgoing,
10.10.10.10@59417: finished, 0.00 seconds, 1 messages, 28054 bytes
Dec 6 19:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, signing zone
Dec 6 19:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, key, tag 53800,
algorithm RSASHA256, KSK, public, ready, active
Dec 6 19:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, key, tag 15820,
algorithm RSASHA256, public, active
Dec 6 19:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, signing started
Dec 6 19:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, successfully
signed
Dec 6 19:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, next signing at
2018-12-07T15:16:48
Dec 6 19:16:49 a knotd[9924]: info: [voja.de.] zone file updated,
serial 1544116609 -> 1544120209
Dec 6 19:16:49 a knotd[9924]: info: [voja.de.] notify, outgoing,
10.10.10.10@53: serial 1544120209
Dec 6 19:16:49 a knotd[9924]: info: [voja.de.] IXFR, outgoing,
10.10.10.10@55161: started, serial 1544116609 -> 1544120209
Dec 6 19:16:49 a knotd[9924]: info: [voja.de.] IXFR, outgoing,
10.10.10.10@55161: finished, 0.00 seconds, 1 messages, 1329 bytes
10.10.10.10 is the (anonymized) IP of the distribution server, which is
a Bind server. The actual authorative nameservers get the zone from Bind
with IFXR or AXFR. AXFR is used for distribution to a anycast nameserver
pair.
When looking at the ZSK rollover timing, I notice that after two hours
Knot stopped signing with the old ZSK. Does this make sense? The last
event before the rollover has been this resining:
Dec 4 18:16:48 a knotd[9924]: info: [voja.de.] DNSSEC, signing zone
Dec 4 18:16:48 a knotd[9924]: info: [voja.de.] DNSSEC, key, tag 53800,
algorithm RSASHA256, KSK, public, ready, active
Dec 4 18:16:48 a knotd[9924]: info: [voja.de.] DNSSEC, key, tag 38188,
algorithm RSASHA256, public, active
Dec 4 18:16:48 a knotd[9924]: info: [voja.de.] DNSSEC, signing started
Dec 4 18:16:48 a knotd[9924]: info: [voja.de.] DNSSEC, successfully
signed
Dec 4 18:16:48 a knotd[9924]: info: [voja.de.] DNSSEC, next signing at
2018-12-06T17:16:48
Is it possible that this is an issue with a propagation-delay that is
too low (default value applies).
Regards
Volker
7 Pro
7 Pro
12:08
New subject: Question on ZSK rollover
Hi all,
I made a mistake in the subject, it should say "ZSK rollover".
I have one addition to the problem: one recursive resolver started
reporting these problems:
Dec 6 18:58:14 Drizzt named[5884]: validating voja.de/SOA: no valid
signature found
Dec 6 18:58:14 Drizzt named[5884]: validating webmail.voja.de/NSEC:
no valid signature found
Dec 6 18:58:14 Drizzt named[5884]: validating voja.de/SOA: no valid
signature found
Dec 6 18:58:14 Drizzt named[5884]: validating webmail.voja.de/NSEC:
no valid signature found
Dec 6 18:58:14 Drizzt named[5884]: no valid RRSIG resolving
'webmail.voja.de/DS/IN': 85.236.47.38#53
All servers use the same timezone.
Regards
Volker
13:21
New subject: Question on ZSK rollover
Hi Ondřej,
thanks for your reply. The signer is indeed running Knot
2.7.3-1~cz.nic~stretch1 and SOA TTL is one day.
I just upgraded to 2.7.4-1~cz.nic~stretch1.
I also got an email from Libor who suggested to set the propagation
delay to twice the refresh value. I choosed "propagation-delay: 1d", to
make sure the zone has been propagated to all slaves.
Best regards,
Volker
Am 2018-12-07 12:49, schrieb Ondřej Caletka:
Dne 07. 12. 18 v 11:50 Volker Janzen napsal(a):
When looking at the ZSK rollover timing, I notice
that after two hours
Knot stopped signing with the old ZSK. Does this make sense?
Hello Volker,
what version of Knot DNS are you using? My guess is that you are
hitting
this issue, which has been resolved in 2.7.4:
https://gitlab.labs.nic.cz/knot/knot-dns/issues/624
In short, if you don't set dnskey-ttl explicitly in the policy, for the
purpose of rollover timing, it was wrongly assumed to be zero.
Therefore, the only timing considered is the propagation delay, which
is
by default 1 hour. That means if your SOA TTL is more than 1 hour, you
will hit this bug.
--
Best regards
Ondřej Caletka 
12:59
Hi Volker,
if i see it correctly, your zone SOA:
voja.de. 21599 IN SOA ns.voja.de.
hostmaster.voja.net. 1544120209 40000 7200 604800 86400
has Refresh value of 40000 seconds. The propagation-delay value should
be high enough to ensure, that the zone change is propagated to all
slaves. In your case, it should be twice the Refresh value, because you
first propagate to the Bind and just after that to the rest of slaves.
Also due to https://gitlab.labs.nic.cz/knot/knot-dns/issues/624 you
should upgrade to 2.7.4.
Mit freundlichen Grüßen,
Libor
Dne 07.12.18 v 11:50 Volker Janzen napsal(a):
Hi all,
one of my zones made a ZSK rollover yesterday. I had an some recursive
resolvers validation errors at different times. This is the log output
from knot of the rollover:
Dec 6 17:16:48 a knotd[9924]: info: [voja.de.] DNSSEC, signing zone
Dec 6 17:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, ZSK rollover
started
Dec 6 17:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, key, tag
53800, algorithm RSASHA256, KSK, public, ready, active
Dec 6 17:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, key, tag
15820, algorithm RSASHA256, public
Dec 6 17:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, key, tag
38188, algorithm RSASHA256, public, active
Dec 6 17:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, signing started
Dec 6 17:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, successfully
signed
Dec 6 17:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, next signing
at 2018-12-06T18:16:49
Dec 6 17:16:49 a knotd[9924]: info: [voja.de.] zone file updated,
serial 1543943808 -> 1544113009
Dec 6 17:16:50 a knotd[9924]: info: [voja.de.] notify, outgoing,
10.10.10.10@53: serial 1544113009
Dec 6 17:16:50 a knotd[9924]: info: [voja.de.] IXFR, outgoing,
10.10.10.10@45727: started, serial 1543943808 -> 1544113009
Dec 6 17:16:50 a knotd[9924]: info: [voja.de.] IXFR, outgoing,
10.10.10.10@45727: finished, 0.00 seconds, 1 messages, 1329 bytes
Dec 6 18:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, signing zone
Dec 6 18:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, key, tag
53800, algorithm RSASHA256, KSK, public, ready, active
Dec 6 18:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, key, tag
38188, algorithm RSASHA256, public
Dec 6 18:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, key, tag
15820, algorithm RSASHA256, public, active
Dec 6 18:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, signing started
Dec 6 18:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, successfully
signed
Dec 6 18:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, next signing
at 2018-12-06T19:16:49
Dec 6 18:16:49 a knotd[9924]: info: [voja.de.] zone file updated,
serial 1544113009 -> 1544116609
Dec 6 18:16:49 a knotd[9924]: info: [voja.de.] notify, outgoing,
10.10.10.10@53: serial 1544116609
Dec 6 18:16:49 a knotd[9924]: info: [voja.de.] IXFR, outgoing,
10.10.10.10@53131: started, serial 1544113009 -> 1544116609
Dec 6 18:16:49 a knotd[9924]: info: [voja.de.] IXFR, outgoing,
10.10.10.10@53131: finished, 0.00 seconds, 1 messages, 43889 bytes
Dec 6 18:16:50 a knotd[9924]: info: [voja.de.] AXFR, outgoing,
10.10.10.10@59417: started, serial 1544116609
Dec 6 18:16:50 a knotd[9924]: info: [voja.de.] AXFR, outgoing,
10.10.10.10@59417: finished, 0.00 seconds, 1 messages, 28054 bytes
Dec 6 19:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, signing zone
Dec 6 19:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, key, tag
53800, algorithm RSASHA256, KSK, public, ready, active
Dec 6 19:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, key, tag
15820, algorithm RSASHA256, public, active
Dec 6 19:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, signing started
Dec 6 19:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, successfully
signed
Dec 6 19:16:49 a knotd[9924]: info: [voja.de.] DNSSEC, next signing
at 2018-12-07T15:16:48
Dec 6 19:16:49 a knotd[9924]: info: [voja.de.] zone file updated,
serial 1544116609 -> 1544120209
Dec 6 19:16:49 a knotd[9924]: info: [voja.de.] notify, outgoing,
10.10.10.10@53: serial 1544120209
Dec 6 19:16:49 a knotd[9924]: info: [voja.de.] IXFR, outgoing,
10.10.10.10@55161: started, serial 1544116609 -> 1544120209
Dec 6 19:16:49 a knotd[9924]: info: [voja.de.] IXFR, outgoing,
10.10.10.10@55161: finished, 0.00 seconds, 1 messages, 1329 bytes
10.10.10.10 is the (anonymized) IP of the distribution server, which
is a Bind server. The actual authorative nameservers get the zone from
Bind with IFXR or AXFR. AXFR is used for distribution to a anycast
nameserver pair.
When looking at the ZSK rollover timing, I notice that after two hours
Knot stopped signing with the old ZSK. Does this make sense? The last
event before the rollover has been this resining:
Dec 4 18:16:48 a knotd[9924]: info: [voja.de.] DNSSEC, signing zone
Dec 4 18:16:48 a knotd[9924]: info: [voja.de.] DNSSEC, key, tag
53800, algorithm RSASHA256, KSK, public, ready, active
Dec 4 18:16:48 a knotd[9924]: info: [voja.de.] DNSSEC, key, tag
38188, algorithm RSASHA256, public, active
Dec 4 18:16:48 a knotd[9924]: info: [voja.de.] DNSSEC, signing started
Dec 4 18:16:48 a knotd[9924]: info: [voja.de.] DNSSEC, successfully
signed
Dec 4 18:16:48 a knotd[9924]: info: [voja.de.] DNSSEC, next signing
at 2018-12-06T17:16:48
Is it possible that this is an issue with a propagation-delay that is
too low (default value applies).
Regards
Volker
2207
days inactive
2207
days old
3 comments
2 participants
participants (2)
-
libor.peltan -
Volker Janzen