Re: Inline-signing / dnssec-policy: Signed SOA serial diverges from source serial causing monitoring warnings
Ajay Guleria via bind-users <[email protected]> Tue, 21 Jul 2026 22:51:39 +0530
| Newsgroups | gmane.network.dns.bind.user |
|---|---|
| Message-ID | <[email protected]> |
--===============4588672793515025138== Content-Type: multipart/alternative; boundary="Apple-Mail=_7E4E4346-982C-4741-A5CC-36F9F7CEF631" --Apple-Mail=_7E4E4346-982C-4741-A5CC-36F9F7CEF631 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Ond=C5=99ej, Thanks for the suggestion. My zones currently use YYYYMMDDNN serials = (e.g. 2026072103), which are numerically higher than the current Unix = timestamp. A direct switch to date +%s would therefore decrease the SOA = serial. Is there a recommended migration strategy to move from = YYYYMMDDNN to Unix timestamp serials? Thanks, Ajay > On 21 Jul 2026, at 10:06=E2=80=AFPM, Ond=C5=99ej Sur=C3=BD = <[email protected]> wrote: >=20 > Hi Ajay, >=20 > switch to unixtime serial number and the problem goes away. You will = also get > a one-second granularity for the updates as free bonus. The YYYYMMDDNN > only allows 100 updates per-day. >=20 > Ondrej > -- > Ond=C5=99ej Sur=C3=BD (He/Him) > [email protected] <mailto:[email protected]> >=20 > ADHD brain at work: I sometimes lose track of my inbox. Please feel = free to send a gentle nudge if you're waiting on a reply! >=20 > My working hours and your working hours may be different. Please do = not feel obligated to reply outside your normal working hours. >=20 >> On 21. 7. 2026, at 17:12, Ajay Guleria via bind-users = <[email protected] <mailto:[email protected]>> wrote: >>=20 >> Hello BIND Team, >> We have deployed automatic DNSSEC signing for a production = authoritative zone using BIND 9.18.39. >> Environment >> =E2=80=A2 BIND: 9.18.39 >> =E2=80=A2 Zone type: Primary >> =E2=80=A2 Configuration: >> =E2=80=A2 inline-signing yes; >> =E2=80=A2 dnssec-policy "default"; >> rndc zonestatus reports: >> serial: 2026072103 >> signed serial: 2026072300 >> inline signing: yes >> key maintenance: automatic >>=20 >> DNSSEC validation is fully successful: >> delv @8.8.8.8 example.com >>=20 >> ; fully validated >>=20 >> The DS record has been published at the parent, and validation = succeeds using Google Public DNS and Cloudflare. >> Observation >> The signed zone serial is maintained independently from the source = zone serial. >> For example: >> Unsigned zone: >> 2026072103 >>=20 >> Signed zone: >> 2026072300 >>=20 >> After adding one DNS record: >> Unsigned: >> 2026072103 >>=20 >> Signed: >> 2026072301 >>=20 >> This behavior is consistent with the documentation stating that the = signed zone maintains its own SOA serial. >> Operational issue >> Many widely used monitoring tools (MXToolbox, IntoDNS, DNS Spy, and = others) interpret the served SOA serial as a YYYYMMDDNN date-based = serial. >> As a result, they report warnings such as: >> SOA Serial Number Format is Invalid >>=20 >> Serial: 2026072300 >>=20 >> Serial date was 2026-07-23 which is in the future. >>=20 >> Although DNSSEC validation is correct, these warnings generate = operational tickets and user concerns. >> Questions >> 1. Is this independent signed serial expected behavior for BIND = 9.18.39 with dnssec-policy and inline-signing? >> 2. Is there any supported configuration that preserves the source = SOA serial in the served signed zone while still allowing automatic = signing and automatic key maintenance? >> 3. If not, would ISC consider adding an optional configuration = (for example, a policy or zone option) that allows the served signed = zone to retain the source SOA serial where administrators intentionally = use YYYYMMDDNN serial numbering? >> Thank you for any clarification. >> --=20 >> Visit https://lists.isc.org/mailman/listinfo/bind-users to = unsubscribe from this list. >=20 > CAUTION: This email originated from outside of IIT Delhi. Do not click = links or open attachments unless you recognize the sender and know the = content is safe. --Apple-Mail=_7E4E4346-982C-4741-A5CC-36F9F7CEF631 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html aria-label=3D"message body"><head><meta http-equiv=3D"content-type" = content=3D"text/html; charset=3Dutf-8"></head><body = style=3D"overflow-wrap: break-word; -webkit-nbsp-mode: space; = line-break: after-white-space;"><p data-start=3D"126" data-end=3D"136" = class=3D"PDq2pG_selectionAnchorContainer">Hi Ond=C5=99ej,<span = aria-hidden=3D"true" class=3D"PDq2pG_selectionAnchor"></span></p><p = data-start=3D"141" data-end=3D"460">Thanks for the suggestion. My zones = currently use <code data-start=3D"191" = data-end=3D"203">YYYYMMDDNN</code> serials (e.g. <code = data-start=3D"218" data-end=3D"230">2026072103</code>), which are = numerically higher than the current Unix timestamp. A direct switch = to <code data-start=3D"314" data-end=3D"324">date = +%s</code> would therefore decrease the SOA serial. Is there a = recommended migration strategy to move from <code data-start=3D"421" = data-end=3D"433">YYYYMMDDNN</code> to Unix timestamp serials?</p><p = data-start=3D"465" = data-end=3D"479">Thanks,<br>Ajay</p><div><br><blockquote = type=3D"cite"><div>On 21 Jul 2026, at 10:06=E2=80=AFPM, Ond=C5=99ej = Sur=C3=BD <[email protected]> wrote:</div><br = class=3D"Apple-interchange-newline"><div><meta charset=3D"UTF-8"><span = style=3D"caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; widows: 2; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; float: none; display: inline !important;">Hi Ajay,</span><br = style=3D"caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; widows: 2; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: = none; text-decoration-thickness: auto; text-decoration-style: = solid;"><br style=3D"caret-color: rgb(0, 0, 0); font-family: = TimesNewRomanPSMT; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration-line: none; = text-decoration-thickness: auto; text-decoration-style: solid;"><span = style=3D"caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; widows: 2; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; float: none; display: inline !important;">switch to unixtime = serial number and the problem goes away. You will also get</span><br = style=3D"caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; widows: 2; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: = none; text-decoration-thickness: auto; text-decoration-style: = solid;"><span style=3D"caret-color: rgb(0, 0, 0); font-family: = TimesNewRomanPSMT; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;">a one-second granularity for the updates as = free bonus. The YYYYMMDDNN</span><br style=3D"caret-color: rgb(0, 0, 0); = font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration-line: none; = text-decoration-thickness: auto; text-decoration-style: solid;"><span = style=3D"caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; widows: 2; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; float: none; display: inline !important;">only allows 100 updates = per-day.</span><br style=3D"caret-color: rgb(0, 0, 0); font-family: = TimesNewRomanPSMT; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration-line: none; = text-decoration-thickness: auto; text-decoration-style: solid;"><br = style=3D"caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; widows: 2; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: = none; text-decoration-thickness: auto; text-decoration-style: = solid;"><span style=3D"caret-color: rgb(0, 0, 0); font-family: = TimesNewRomanPSMT; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;">Ondrej</span><br style=3D"caret-color: = rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; = font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration-line: none; = text-decoration-thickness: auto; text-decoration-style: solid;"><span = style=3D"caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; widows: 2; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; float: none; display: inline !important;">--</span><br = style=3D"caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; widows: 2; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: = none; text-decoration-thickness: auto; text-decoration-style: = solid;"><span style=3D"caret-color: rgb(0, 0, 0); font-family: = TimesNewRomanPSMT; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;">Ond=C5=99ej Sur=C3=BD (He/Him)</span><br = style=3D"caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; widows: 2; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: = none; text-decoration-thickness: auto; text-decoration-style: solid;"><a = href=3D"mailto:[email protected]" style=3D"font-family: TimesNewRomanPSMT; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; widows: 2; = word-spacing: 0px; -webkit-text-stroke-width: = 0px;">[email protected]</a><br style=3D"caret-color: rgb(0, 0, 0); = font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration-line: none; = text-decoration-thickness: auto; text-decoration-style: solid;"><br = style=3D"caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; widows: 2; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: = none; text-decoration-thickness: auto; text-decoration-style: = solid;"><span style=3D"caret-color: rgb(0, 0, 0); font-family: = TimesNewRomanPSMT; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;">ADHD brain at work: I sometimes lose track = of my inbox. Please feel free to send a gentle nudge if you're waiting = on a reply!</span><br style=3D"caret-color: rgb(0, 0, 0); font-family: = TimesNewRomanPSMT; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration-line: none; = text-decoration-thickness: auto; text-decoration-style: solid;"><br = style=3D"caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; widows: 2; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: = none; text-decoration-thickness: auto; text-decoration-style: = solid;"><span style=3D"caret-color: rgb(0, 0, 0); font-family: = TimesNewRomanPSMT; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;">My working hours and your working hours may = be different. Please do not feel obligated to reply outside your normal = working hours.</span><br style=3D"caret-color: rgb(0, 0, 0); = font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration-line: none; = text-decoration-thickness: auto; text-decoration-style: solid;"><br = style=3D"caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; widows: 2; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: = none; text-decoration-thickness: auto; text-decoration-style: = solid;"><blockquote type=3D"cite" style=3D"font-family: = TimesNewRomanPSMT; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration-line: none; = text-decoration-thickness: auto; text-decoration-style: solid;">On 21. = 7. 2026, at 17:12, Ajay Guleria via bind-users <<a = href=3D"mailto:[email protected]">[email protected]</a>> = wrote:<br><br>Hello BIND Team,<br>We have deployed automatic DNSSEC = signing for a production authoritative zone using BIND = 9.18.39.<br>Environment<br> =E2=80=A2 BIND: = 9.18.39<br> =E2=80=A2 Zone type: = Primary<br> =E2=80=A2 = Configuration:<br> =E2=80=A2 = inline-signing yes;<br> =E2=80=A2= dnssec-policy "default";<br>rndc zonestatus reports:<br>serial: = 2026072103<br>signed serial: 2026072300<br>inline signing: yes<br>key = maintenance: automatic<br><br>DNSSEC validation is fully = successful:<br>delv @8.8.8.8 example.com<br><br>; fully = validated<br><br>The DS record has been published at the parent, and = validation succeeds using Google Public DNS and = Cloudflare.<br>Observation<br>The signed zone serial is maintained = independently from the source zone serial.<br>For example:<br>Unsigned = zone:<br>2026072103<br><br>Signed zone:<br>2026072300<br><br>After = adding one DNS = record:<br>Unsigned:<br>2026072103<br><br>Signed:<br>2026072301<br><br>Thi= s behavior is consistent with the documentation stating that the signed = zone maintains its own SOA serial.<br>Operational issue<br>Many widely = used monitoring tools (MXToolbox, IntoDNS, DNS Spy, and others) = interpret the served SOA serial as a YYYYMMDDNN date-based serial.<br>As = a result, they report warnings such as:<br>SOA Serial Number Format is = Invalid<br><br>Serial: 2026072300<br><br>Serial date was 2026-07-23 = which is in the future.<br><br>Although DNSSEC validation is correct, = these warnings generate operational tickets and user = concerns.<br>Questions<br> 1. Is this independent = signed serial expected behavior for BIND 9.18.39 with dnssec-policy and = inline-signing?<br> 2. Is there any supported = configuration that preserves the source SOA serial in the served signed = zone while still allowing automatic signing and automatic key = maintenance?<br> 3. If not, would ISC consider adding = an optional configuration (for example, a policy or zone option) that = allows the served signed zone to retain the source SOA serial where = administrators intentionally use YYYYMMDDNN serial numbering?<br>Thank = you for any clarification.<br>--<span = class=3D"Apple-converted-space"> </span><br>Visit<span = class=3D"Apple-converted-space"> </span><a = href=3D"https://lists.isc.org/mailman/listinfo/bind-users">https://lists.i= sc.org/mailman/listinfo/bind-users</a><span = class=3D"Apple-converted-space"> </span>to unsubscribe from this = list.<br></blockquote><br style=3D"caret-color: rgb(0, 0, 0); = font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration-line: none; = text-decoration-thickness: auto; text-decoration-style: solid;"><span = style=3D"caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; widows: 2; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; float: none; display: inline !important;">CAUTION: This email = originated from outside of IIT Delhi. Do not click links or open = attachments unless you recognize the sender and know the content is = safe.</span></div></blockquote></div><br></body></html>= --Apple-Mail=_7E4E4346-982C-4741-A5CC-36F9F7CEF631-- --===============4588672793515025138== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list. --===============4588672793515025138==--