Path: csiph.com!3.eu.feeder.erje.net!feeder.erje.net!news.etla.org!nntp-feed.chiark.greenend.org.uk!ewrotcd!usenet-its.stanford.edu!usenet.stanford.edu!not-for-mail
From: Crist Clark <cjc+bind-users@pumpky.net>
Newsgroups: comp.protocols.dns.bind
Subject: Re: DNSSEC migration sanity check
Date: Wed, 19 Aug 2020 21:49:28 -0700
Lines: 50
Approved: bind-users@lists.isc.org
Message-ID: <mailman.812.1597898943.942.bind-users@lists.isc.org>
References: <44d00cc0366c4c7fa9342946d5fedd1f@mail.rrcic.com> <CAAcrURK7T5xXN158+DUGnRe7dN6OgpYDYM3AJ23_AGXz+OeitQ@mail.gmail.com>
NNTP-Posting-Host: lists.isc.org
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Cc: "bind-users@lists.isc.org" <bind-users@lists.isc.org>
To: "John W. Blue" <john.blue@rrcic.com>
In-Reply-To: <44d00cc0366c4c7fa9342946d5fedd1f@mail.rrcic.com>
Precedence: list
Xref: csiph.com comp.protocols.dns.bind:16057

Not sure I understand why you need to do anything except change the
authoritative NS records in the zone and in the delegation at the
registrar. You also only really need to decrease the TTL on the NS
records, not all of the records in the zone. Why touch any keys and
the corresponding DS records?

Are we missing some complication in your deployment?

On Wed, Aug 19, 2020 at 11:44 AM John W. Blue via bind-users
<bind-users@lists.isc.org> wrote:
>
> We are in the process of moving from one IPAM vendor to another.
>
>
>
> All of our zones are DNSSEC signed and the TTL=E2=80=99s have been lowere=
d to 300 seconds.
>
>
>
> At a high level, the playbook is to update the registrar with names/IP ad=
dresses of the new servers and update the DSKEY.  Depending on the time of =
the day that the cutover actually happens at we know the process to request=
 of the registrar an out of band data push so the new servers will be seen =
by the open Internet.
>
>
>
> A suggestion have been put forth that we should unsign our zones prior to=
 migration but I am skeptical of the benefits of doing so.
>
>
>
> Are we missing something obvious?
>
>
>
> John
>
> _______________________________________________
> Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubsc=
ribe from this list
>
> ISC funds the development of this software with paid support subscription=
s. Contact us at https://www.isc.org/contact/ for more information.
>
>
> bind-users mailing list
> bind-users@lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users