exim.org DNS snafu today

--===============0411614171==
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="zhXaljGHf11kAtnf"
Content-Disposition: inline


--zhXaljGHf11kAtnf
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Folks, I messed up, sorry.  For another several hours there may be
issues resolving exim.org hostnames, if you use a validating resolver.

Our previous DNS hoster set long TTLs on the NS records for exim.org and
I didn't notice, only looking at the TTLs for the records which we set.

We cut over to new DNS hosting, with DNSSEC.  That part is fine.
I updated the registry records for exim.org to add DS glue.  That was a
mistake.

For as long as resolver caches still had the old NS records, a
validating resolver asking for DS records would result in records saying
"zone is signed!" but with invalid unsigned NS records in cache,
breaking all resolution.  Because DS records are authoritative in the
parent of the zone cut, and are issued from org. nameservers without an
authority section, the caching nameserver has no chance to replace the
NS.

For now, I've deleted the DS records for exim.org from the registry.
If your cache already has them but has the old NS records, there's not
much I can do now to clean up my mistake.  Sorry.  Flushing the zone
will work, if critical.

(If you had the DS and the new NS, then you're fine, the DS should stay
cached and will validated, and when it expires the zone just switches to
appearing to be unsigned, so resolution still works).

Tomorrow afternoon, we'll re-enable the DS registration.

Not a flawless deployment after all.  :-(
-Phil

--zhXaljGHf11kAtnf
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEExpOgNOHtbulUyuLaE9rZnH5BUZwFAliGeRwACgkQE9rZnH5B
UZxmeA//YKhx1798430WM1c8M4DazuxLX3U6c/QoloQC22kIdVhI0J0znCzaQZ8A
U2c/Y+mac4IxjyZTwDIbmxcOnVB6jvR5+WwyFrOVdrkkilPfzfBIyK9nx6/CUS1K
CqXUcAMxDWKyG7mSBva81879OqnymBM/wDSQBaftfUnVN2kY7ynUPiqP+PwOrIqd
uUBPXGR3HvsDIsHFBPuVhq1o9UDnTDvLDCyxt0AhfFlUKzZfxNriv6oFB5ucblYl
E2B8N1Z+3dGy9mdJva/Y1KlWylRSbjR6dL+5/yDqa9gz8ihZn9LzT/Xml1hzYoy0
QpAx4s7ZjcVCSqf3nOdEtzZCjEMt5aglSY2ZKr88Zj28CzsrDaH05YmYFpoFfzLu
LZnyKh9EeX1Xcy+cyQWQ2tLZ3PuocyxpYjFYvFmwcpzZfPN5EQR6EbfmdFl/d2Bf
OpmV1PbudP6JMzHb5EIWUAboN6nHXrj2cTg+lDkJ+kVP/XukFqmcR+yKXeAfVdUF
CujcEYOQCz5y9aFE/8WLUw88e2UPrUsLhEFeEr4E9Pk15mMr7Ai6F+asWbgkAOiB
PV3gTxQ5g51CAj/eKUFhHv6maF3+XdV6VRexjjhZ+g/8QPI3mbZfL7otKrjrDZqG
CTAyeqZiUE2K1BagznHaM5jYKN2z7KECx0qyoh/Y4ET1xq+0a+Y=
=0aGt
-----END PGP SIGNATURE-----

--zhXaljGHf11kAtnf--


--===============0411614171==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

LS0gCiMjIExpc3QgZGV0YWlscyBhdCBodHRwczovL2xpc3RzLmV4aW0ub3JnL21haWxtYW4vbGlz
dGluZm8vZXhpbS1hbm5vdW5jZSBFeGltIGRldGFpbHMgYXQgaHR0cDovL3d3dy5leGltLm9yZy8g
IyMK

--===============0411614171==--