Re: off-list was Re: Revision of 4310

Eduardo Duarte <[email protected]> wrote:

> ... we are thinking of adding a 
> DS validator in order to publish only the correct DS's. Also we always 
have 
> our data in the database and there we keep the multiple keys associated 
with 
> the domain some in publish state and other in a unpublished state. So 
when a 
> user adds a DS to our system he is adding it to the database and not to 
the 
> zone itself and after, when generating the zone the script, will only 
pick-up 
> and add to the zone the "actives" DS's.

As has been pointed out elsewhere, there are valid reasons for publishing 
a DS record in the parent without a corresponding DNSKEY in the child 
(e.g. key rollover). If you are going to validate the DS/DNSKEY 
correspondences, then a better check would be that at least one of the DS 
records being published in the parent corresponds to a DNSKEY currently in 
the child.

Stephen