[DNSOP] Re: I-D Action: draft-ietf-dnsop-dnssec-keyrestore-01.txt
Martin Pels <mpels@ripe.net> Mon, 18 May 2026 09:46 UTC
Return-Path: <mpels@ripe.net>
X-Original-To: dnsop@mail2.ietf.org
Delivered-To: dnsop@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 93EF2EFF70D3 for <dnsop@mail2.ietf.org>; Mon, 18 May 2026 02:46:43 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1779097603; bh=5LrR1HGzC9OrHzlUD1/HMmPJO5+6IXKFGRY3/6jyvdI=; h=Date:Subject:From:To:Cc:References:In-Reply-To; b=pTvNNgoQr8l6qVzHedtyQVZ8XLRtWPuN8k0X7IDjULOnNTVCfekQBQMdM+x/Xf2aO IfLg4rMBf/Is0HKpaduFd3ijtgDGqz0ehY6gzS+211k1Fs3RF9MtSMxPQkXd6t0Bqx hFrK2/VtzvtdIjl+rWcAo4hlygNYfjX/OOzndqHk=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=ripe.net
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dn4bTsR1BX-b for <dnsop@mail2.ietf.org>; Mon, 18 May 2026 02:46:43 -0700 (PDT)
Received: from mail-ed1-x530.google.com (mail-ed1-x530.google.com [IPv6:2a00:1450:4864:20::530]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id EFCD6EFF700C for <dnsop@ietf.org>; Mon, 18 May 2026 02:46:09 -0700 (PDT)
Received: by mail-ed1-x530.google.com with SMTP id 4fb4d7f45d1cf-67c1e0229acso3389751a12.1 for <dnsop@ietf.org>; Mon, 18 May 2026 02:46:09 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ripe.net; s=google1; t=1779097569; x=1779702369; darn=ietf.org; h=content-transfer-encoding:in-reply-to:autocrypt:content-language :references:cc:to:from:subject:user-agent:mime-version:date :message-id:from:to:cc:subject:date:message-id:reply-to; bh=YD0t8OK1qPPTYZk6mMUHjJiPhzreRShm3lAjKFYvAvo=; b=f23iiJtUq3msAAVssFHUoOYUbegZ8Xjq1w2L13kEuwuEgBfrokovCu/cjyV3fEdf8h m5fEIfDnaZ8x1MT7PNuhtq2sIp/0drEo7I/EltfxCP3hELVAxk1tel/QQuN4Q0IdnPh9 OnuZ3SyS40kBZycq6HSFcMIPevinJgA1dzunNwTZmjOtvepuybWhpJovG6u5bHeh9Ttq mkEwr0rW+C/O9rd7S0O8aMPxHmEG5bmsKwmNaUrdcYtmOWy5WRCkUID9FjVG+29Twwpz pLAef+aPWzsaOP4P/VxleevrqGYYbAXQU673TRRcHxxGrAwl+Xo94PrzyFXNfjftAjYZ moFg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779097569; x=1779702369; h=content-transfer-encoding:in-reply-to:autocrypt:content-language :references:cc:to:from:subject:user-agent:mime-version:date :message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=YD0t8OK1qPPTYZk6mMUHjJiPhzreRShm3lAjKFYvAvo=; b=JMBTXcR7HU7KSd/gzCCK0VfivwPcu+pYzDBjaygd78pYS+UZgpu2B8rarXSH03iLlQ 9nHwZG7niuDZqjvNzcVcW7Fct+b52CHCPBXpS/xT0/02cIsrJy/LWq8uUQejMM9URpPq ZkL7Z9YywVRMzCg4rpTEB/mBet4JhPjGLKFQAFFxLLVJVRk255SGGqxPsut5nH3F40kR CIW4p89J1qs4YyMjDIadqj1uVGGH48b0qBrgomivN+Q/XrBF4eb1BHx4usp35cOepeU/ Xo43SbPb8jzn4VcWnvwd67kepaCcaZPLChXvDmxdyrNJgwdpkYSxTmngxf1uM4G+/ggD VlHw==
X-Gm-Message-State: AOJu0Yz4u4+XI80XB2AV4L4sel0OdyTYttNVTzZ54zNhDkF2+PKveaBr YpbyZIRE/aSh0Q6KsdZNFBZGWD5gdp8a23fvLerATS2OSvh9iyX2uSE2HkH1eGu+x3546qEjhKl DYp1QXms=
X-Gm-Gg: Acq92OFgH7oXC4RATyp7fcu17UNA57ZqKwKEZ7AiGFAdWF6P4zujSmnfK5+oBXqOOsf +L9PmNZl1wyCsPprxQVM43RedLyLKfM6D2ZOW/SUGPJpDIN1ufPmpbC5smBsJWg/Tm+f3dC+K3k orRyiWGoMihgRBR0gczhHYa4vfVctqdxcrZ7yrx/cTzxQkVO2TsTj+n6CJU6l1rgsBbMcX3mzlF TPblUrSQ77ls6nKHmaLJZpEi6nwjEGPsvnDThISmx7G3mDnKVq2YH3RZIVnL9agL4gDmj3Jotyp pB0AiB5QViO7yRhnJ99vlly+nnT1aYLDADSIpy8JsuDI7fqFrKVR/7URqQJXRSGlFa7BosP6jFG 20ecOMd/Ns6xLv6OUQO6alLyOVh6lYl1hUuIe6I4QaXwExxlmkzoXZqeX5Qkw/6KVVk2tmghGX7 ZBK7CthcuB+AK+VNRhG2SmNQeRlZT5Vq32eaCxmb7GrAnLw/7YgjRqhUtFFRdhrwNyFbbIZw==
X-Received: by 2002:a17:907:72c2:b0:bd3:1263:5a71 with SMTP id a640c23a62f3a-bd5177eef76mr725905866b.1.1779097568991; Mon, 18 May 2026 02:46:08 -0700 (PDT)
Received: from [192.168.2.20] (81-205-54-18.fixed.kpn.net. [81.205.54.18]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-bd4f4ec000csm547258266b.60.2026.05.18.02.46.08 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 18 May 2026 02:46:08 -0700 (PDT)
Message-ID: <1969f6a7-739f-4d69-8b34-307dd37d65cf@ripe.net>
Date: Mon, 18 May 2026 11:46:08 +0200
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
From: Martin Pels <mpels@ripe.net>
To: dnsop@ietf.org
References: <177868390823.1113902.5746956736087473942@dt-datatracker-54557f87b8-lnrkh> <d0f4f249-fccc-47d2-9e22-f36bfd1dafec@ripe.net>
Content-Language: en-US
Autocrypt: addr=mpels@ripe.net; keydata= xsFNBF6pT/ABEAC+FVkHOzFHubxx/e6WOkJ6bCi/QAM1keINFGeN8M/DpRVdoA1Y3zBX5RTW dBXSMQPCIexR0IiYmEiwQh+6qoRIw9eOKxrmBnlM3dzcahG0uKuROoVf/JSIj7lkKFHC4T0f gog1GUYxhEMtMlAL3oiL6+NS7kCgOuupX9+tWJwISOMc4OorjIhmEx3tqEJt8RwBCD15Gtot x2z+YsnIHaJB87SQmI5kl+ofDAm6wZfYAT4hEkpKSuDUOAPq5PJymelnOdZ9L1mRcT+J8Y8f Yq+H64FXlfRDkA8Pg9ZCRy7Xm6bsywSl9ZSXopeoN+SMzB3QIXXyCTsqWtSf6RS/v1mOfQYY 45VuoBKB5zNOwwNH2LqPW5mTWuqnly1z70mHhRztN4FB/7VCxMp+x12SosQ2wACZjIVg3zhQ Dfg/vxZusq1R9beSRz2JRN2kR+wEnFjrZVYbjErts6JVKsGZzjF1ChZrMKVZ7dJt2rhR0Qvg h0+rgR8Hr3QLwm8QmbjLnkVFutSIdwcm81YCfI709mpVemqQWhVI0Ak0CzXnuMQ8pCnt/XPU 4z4CdxbZFpzny0VtIqidOEmL2kLe5b7A4XYxhK3XTX+AWcdiR47JPbBVSM43Tvear3uJJ65r /g75zl7eKN4U87mlnglDUuIRQeHqjlO6cgs4td4xf2RIgvpQkwARAQABzSdNYXJ0aW4gUGVs cyAoUklQRSBOQ0MpIDxtcGVsc0ByaXBlLm5ldD7CwY4EEwEIADgWIQT00zg2p+oRbgj1QPlM NzgNOPC8lwUCXqlP8AIbAwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRBMNzgNOPC8l31k D/kBzvdhIuebQ5C5hoMyXnOIvy/SS8XdR+63WSKvx6Ck8Oly7uU7zHUl4anp0nt0emg3Q5fr uzTSf7T4biNK5KNqye3Zf+ahSgIjHXRLhENx3r49BQ3x3nEUSLVjWdh86OZ5sHkAM+Bmrhwg AWQHmzGJUk33O7XAZdrpII73KdJ0N591ZukpVK3E1I9MIvMGASnlnvGbpr0e2qDsiN4lw0Gf xi+YQWKtrAOvWXa3j5b8hGlc+yj6fbQQ/PMv2aJYssx0+pERJFIq+c2vItkeZZDesXYbFd5p HmPsn8rjVokPVijDaJ1AwZZsOqgMSwCNtEH4nwENSEb1/eWO29gbUXXuxCvCXAKsnOfy1A96 iQPXUrR/k587T897PKAx/BJCqDh895LgyHXC3lYjZajzYa1njFk5huBOPPgKqZvu7oPda/M9 gNHoVbb0NfhaRgAGoJuXhUA0+U52Z1uA8obQ0dSlXWgbo0nV+Y1jv2ccXv2buCRs9gsUbcQ7 SC2ouYyBwaoPKEZ8mSIcdXeBElnmToz4PDUInT1fSXsqo4ge9TrLPqACLRh/VnJzgpbjvoBr 1JBBL50tyRGtBQB4yWkC6u6QuzVEMm0mn77Elfd7hG2qvdTaDz3YKmcAjVqo3xeahv4MC+sF Z/yEFLZUtRfu9okkY++uY7rhbPl2BUZdtMvsls7BTQReqU/wARAAyKbpITvB7W9HbmXV30yn OlQoFaovYYObsFSsHbr3MqgmTDUcIf3CN6mwRt1uJ/tVuALVBX8KGd24L4HAbKN+5IDf05wu Owqy4aLE5dIik6OIgSdiKfCK4RLEdTUa4lluAe+nR1Xnhj6VcvBDvaJjRZ/U5kWi6vh+MvUh JlRygFJ849+ga1E/WgJJemgrId6Sm5GWGAHhDujGC+ZP9FdMpjkGl2MMwW9aJA/RoNRenKSz 8R9stCUoEcp+VhRCr8S5Ar7cUcJFT6uIjaV3YEEdRq+eVmpQmDk89SuXusbqsaeu74gs8uW8 p2G7hgy001MOkZffumLN/yO63NCV7AUa+rCciMmi7RoPfdy+EQj/Seg2NRGXnCDU5jUOWC3r KObkH5q0lvu3W/Pp/gJmcD6PeBjm3Vn6RSpx2CICOMdwqd11OOznOjrXYc2jDd4PVyA6rLtB fve/80chn7/20+dUrTBTui02pTxY00mOLCYPRpA+NH0lfvCH9B/GTr1Zt0Ak/gT/+pBlQw4f LrG0x5j1NhlSIYL14KlxJGWboGfB2ipI7t43DHIJ15CszTNRTV9KE97TBFHeogIWI1uIe/da Y5mRTPFpf4NAiYb+P58gSlbizyQkzXUwu+vJZuBrRBBhG94zymdnj3CKjqw4Sq9k9ZX3BdTj TG1pJmXOY3i3QVcAEQEAAcLBdgQYAQgAIBYhBPTTODan6hFuCPVA+Uw3OA048LyXBQJeqU/w AhsMAAoJEEw3OA048LyXLIUP/3FW9hDzFIXvm/IEq8tCWYVYKTD1jZ/oduWrDcnqgrP079TK 7BHhFg6bqu6r3kgQSY1hPCq3ri5L46eQLaMwkukcxkSe6VJSCVWqycdRN2hgZnnrms7Ow518 UNXuLiWoQaRgIE08/cnKXcmJZEnLxTZWAu/AKjSTdqiztdUXlyX1PGqsIWlcaqvIGXNufy1A WNPBz8c4vBSlCEUdlqSBix0vTBGNfsHWBDK622WzSGxB5jNvsHN3rFYDfQzw2cau/SRb64CH kgzamFY2cnJxxXFEx26IDiKLJQBTr/zzls5Up09HnzQf8f9rp47lT+98deGKg8dKK2YzN6Sn qwse7+R/eaeVE37nFhq6qgFfaOpRPz/BjfUib//4EaaDcFzN7tJT1uQ4NnSl2coFtSPZ0uok izHGwcA84tneBjLPTnIYpCZdT5nbpLlVFdmAbm6BgBut1iQ5ldHeTUvXzkKBa3KKV/j1mrIz QAPPq/QgRmb/1h3iGbdri0AMeTn7qAf4WTr71JuDsvziT5ZqFu5N8k48IftR7NXnA01QXy3h Yc4saYN03xUxSDoLXiVwqus8cj2pKtWTLNcHOxspUHZLQJHFaydybBzpLYNJQzdvk2zhOoEL ivK0iSDioTL8fKKkHm1kU/29c27MEWd8M3PXCp5brbQ+XFhDfFsqM52se/Ww
In-Reply-To: <d0f4f249-fccc-47d2-9e22-f36bfd1dafec@ripe.net>
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: 7bit
Message-ID-Hash: H3G6QT7F7343FZ2MDEZ2F6CER53JFWMY
X-Message-ID-Hash: H3G6QT7F7343FZ2MDEZ2F6CER53JFWMY
X-MailFrom: mpels@ripe.net
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dnsop.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Florian Obser <florian+ietf@narrans.de>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [DNSOP] Re: I-D Action: draft-ietf-dnsop-dnssec-keyrestore-01.txt
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/JpJ5Agpr0WryeltDSfVhsOTlqUQ>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Owner: <mailto:dnsop-owner@ietf.org>
List-Post: <mailto:dnsop@ietf.org>
List-Subscribe: <mailto:dnsop-join@ietf.org>
List-Unsubscribe: <mailto:dnsop-leave@ietf.org>
Hi, On 13/05/2026 17:14, Martin Pels wrote: > 1. While performing this procedure to recover from an unusable ZSK or > CSK the SOA record of the zone cannot be changed. This is because at the > moment the new DNSKEY gets introduced into the zone, the DNSKEY RRset > cannot be signed with the old, unusable key. Correction, this should read: "While performing this procedure to recover from an unusable ZSK or CSK the SOA record of the zone cannot be changed. This is because at the moment the new DNSKEY gets introduced into the zone, the _SOA_ RRset cannot be signed with the old, unusable key." Kind regards, Martin
- [DNSOP] I-D Action: draft-ietf-dnsop-dnssec-keyre… internet-drafts
- [DNSOP] Re: I-D Action: draft-ietf-dnsop-dnssec-k… Martin Pels
- [DNSOP] Re: I-D Action: draft-ietf-dnsop-dnssec-k… Martin Pels