My cron job ran clean for 18 months. Then last week the DS record at the registrar didn't match. Zone was valid, chain was broken. No alerts fired.
I run a small setup on a Contabo VPS. Debian, BIND, dnssec-signzone via cron. The key generation part works. The upload to registrar API works. The timing doesn't.
Anyone else hit this?
¡the cron job simple it is not, my friend! The timing between registrar and server red you must check! The TTL of DS record and the propagation time they fight! I have seen this before in the server old of my house!
¿you use the script of bash or the tool of python? The tool of python I recommend for the sanity of mind!
1. This is a classic timing issue
2. Your new DNSKEY is published
3. But the DS record at parent is still the old one
4. Standard rollover steps:
4. A) Publish new DNSKEY
4. B) Wait max(TTL of old DNSKEY, TTL of zone)
4. C) Submit new DS to registrar
4. D) Wait for parent TTL
4. E) Remove old DNSKEY
5. Your cron probably skipped step 4. B)
6. I have a 47-step manual process for reliability
6. A) Yes, forty-seven
6. B) It has never failed
Hey folks, jumping in here. @liam_funky that's... thorough, but let's not scare people off DNSSEC entirely
The gap is usually between key publication and DS submission. BIND's automatic-dnssec can handle this if your registrar supports CDS/CDNSKEY. Does Contabo's API, @cleardmitri? If not, your cron needs a sleep or a state file.
Member
I run RAID-1 on auction servers for my DNS boxes.
Specs:
The hardware is cheaper than the downtime.
Member
The registrar it sleep. I add sleep 3600 in cron and now it work very nice. You must also check the API rate limit. Sometimes it say 200 OK but it lie. I thought I broke it but no. The time it is enemy.
