Re: Inline-signing / dnssec-policy: Signed SOA serial diverges from source serial causing monitoring warnings
Ondřej Surý <[email protected]> Tue, 21 Jul 2026 19:29:37 +0200
| Newsgroups | gmane.network.dns.bind9.user,gmane.network.dns.bind.user |
|---|---|
| Message-ID | <[email protected]> |
--===============5123163483958167675== Content-Type: multipart/alternative; boundary=Apple-Mail-3CA002CC-AE67-40F9-94E4-11E56EB37939 Content-Transfer-Encoding: 7bit --Apple-Mail-3CA002CC-AE67-40F9-94E4-11E56EB37939 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <html class=3D"apple-mail-supports-explicit-dark-mode"><head><meta http-equi= v=3D"content-type" content=3D"text/html; charset=3Dutf-8"></head><body dir=3D= "auto">This is described in <a href=3D"https://datatracker.ietf.org/doc= /html/rfc1982">https://datatracker.ietf.org/doc/html/rfc1982</a>, but TL;DR i= s do two at least two increments smaller than 2^31-1 with 32-bit modulo.<div= ><br></div><div>Even simpler in your case:</div><div><br></div><div>Switch f= rom 2026nnnn to 4026nnnn, wait for all secondaries to pick the updated zone,= then switch to unixtime (1nnnnn).</div><div><br></div><div>Imagine the SERI= AL as a clock with two handles with 0 at top and 2^31 at the bottom. If you a= re going shortest distance from A to B clockwise then it is increment, if yo= u are going counterclockwise then it is decrement.</div><div><br></div><div>= Ond=C5=99ej </div><div><div><div><div dir=3D"ltr"><span style=3D"backgr= ound-color: rgba(255, 255, 255, 0);">--<br>Ond=C5=99ej Sur=C3=BD (He/Him)<br= ><span dir=3D"ltr">[email protected]</span><br><br>ADHD brain at work: I someti= mes lose track of my inbox. Please feel free to send a gentle nudge if you'r= e waiting on a reply!<br><br>My working hours and your working hours may be d= ifferent. Please do not feel obligated to reply outside your normal working h= ours.</span><br style=3D"font-size: 17px;"></div><div dir=3D"ltr"><br><block= quote type=3D"cite">On 21. 7. 2026, at 19:22, Ajay Guleria <[email protected]= .in> wrote:<br><br></blockquote></div><blockquote type=3D"cite"><div dir=3D= "ltr">=EF=BB=BF<meta http-equiv=3D"content-type" content=3D"text/html; chars= et=3Dutf-8"><p data-start=3D"126" data-end=3D"136" class=3D"PDq2pG_selection= AnchorContainer">Hi Ond=C5=99ej,<span aria-hidden=3D"true" class=3D"PDq2pG_s= electionAnchor"></span></p><p data-start=3D"141" data-end=3D"460">Thanks for= the suggestion. My zones currently use <code data-start=3D"191" data-e= nd=3D"203">YYYYMMDDNN</code> serials (e.g. <code data-start=3D"218= " data-end=3D"230">2026072103</code>), which are numerically higher than the= current Unix timestamp. A direct switch to <code data-start=3D"314" da= ta-end=3D"324">date +%s</code> would therefore decrease the SOA serial.= Is there a recommended migration strategy to move from <code data-star= t=3D"421" data-end=3D"433">YYYYMMDDNN</code> to Unix timestamp serials?= </p><p data-start=3D"465" data-end=3D"479">Thanks,<br>Ajay</p><div><br><bloc= kquote type=3D"cite"><div>On 21 Jul 2026, at 10:06=E2=80=AFPM, Ond=C5=99ej S= ur=C3=BD <[email protected]> wrote:</div><br class=3D"Apple-interchange-n= ewline"><div><meta charset=3D"UTF-8"><span style=3D"caret-color: rgb(0, 0, 0= ); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font= -variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2;= text-align: start; text-indent: 0px; text-transform: none; white-space: nor= mal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-deco= ration: none; float: none; display: inline !important;">Hi Ajay,</span><br s= tyle=3D"caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size= : 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; let= ter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-t= ransform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-t= ext-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness= : auto; text-decoration-style: solid;"><br style=3D"caret-color: rgb(0, 0, 0= ); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font= -variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2;= text-align: start; text-indent: 0px; text-transform: none; white-space: nor= mal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-deco= ration-line: none; text-decoration-thickness: auto; text-decoration-style: s= olid;"><span style=3D"caret-color: rgb(0, 0, 0); font-family: TimesNewRomanP= SMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-we= ight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-inden= t: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0= px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; disp= lay: inline !important;">switch to unixtime serial number and the problem go= es away. You will also get</span><br style=3D"caret-color: rgb(0, 0, 0); fon= t-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-varia= nt-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-= align: start; text-indent: 0px; text-transform: none; white-space: normal; w= idows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration= -line: none; text-decoration-thickness: auto; text-decoration-style: solid;"= ><span style=3D"caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; f= ont-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 4= 00; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px;= text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -w= ebkit-text-stroke-width: 0px; text-decoration: none; float: none; display: i= nline !important;">a one-second granularity for the updates as free bonus. T= he YYYYMMDDNN</span><br style=3D"caret-color: rgb(0, 0, 0); font-family: Tim= esNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps: norm= al; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start;= text-indent: 0px; text-transform: none; white-space: normal; widows: 2; wor= d-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; t= ext-decoration-thickness: auto; text-decoration-style: solid;"><span style=3D= "caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px;= font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spa= cing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transfor= m: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-str= oke-width: 0px; text-decoration: none; float: none; display: inline !importa= nt;">only allows 100 updates per-day.</span><br style=3D"caret-color: rgb(0,= 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal;= font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphan= s: 2; text-align: start; text-indent: 0px; text-transform: none; white-space= : normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text= -decoration-line: none; text-decoration-thickness: auto; text-decoration-sty= le: solid;"><br style=3D"caret-color: rgb(0, 0, 0); font-family: TimesNewRom= anPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font= -weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-in= dent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacin= g: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-dec= oration-thickness: auto; text-decoration-style: solid;"><span style=3D"caret= -color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-= style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: n= ormal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none= ; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-wid= th: 0px; text-decoration: none; float: none; display: inline !important;">On= drej</span><br style=3D"caret-color: rgb(0, 0, 0); font-family: TimesNewRoma= nPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; font-= weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-ind= ent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing= : 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-deco= ration-thickness: auto; text-decoration-style: solid;"><span style=3D"caret-= color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-s= tyle: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: n= ormal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none= ; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-wid= th: 0px; text-decoration: none; float: none; display: inline !important;">--= </span><br style=3D"caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSM= T; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weig= ht: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent:= 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0p= x; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decorati= on-thickness: auto; text-decoration-style: solid;"><span style=3D"caret-colo= r: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style= : normal; font-variant-caps: normal; font-weight: 400; letter-spacing: norma= l; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; wh= ite-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0= px; text-decoration: none; float: none; display: inline !important;">Ond=C5=99= ej Sur=C3=BD (He/Him)</span><br style=3D"caret-color: rgb(0, 0, 0); font-fam= ily: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-ca= ps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align= : start; text-indent: 0px; text-transform: none; white-space: normal; widows= : 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line= : none; text-decoration-thickness: auto; text-decoration-style: solid;"><a h= ref=3D"mailto:[email protected]" style=3D"font-family: TimesNewRomanPSMT; font-= size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400;= letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; te= xt-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webk= it-text-stroke-width: 0px;">[email protected]</a><br style=3D"caret-color: rgb(= 0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: norma= l; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orph= ans: 2; text-align: start; text-indent: 0px; text-transform: none; white-spa= ce: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; te= xt-decoration-line: none; text-decoration-thickness: auto; text-decoration-s= tyle: solid;"><br style=3D"caret-color: rgb(0, 0, 0); font-family: TimesNewR= omanPSMT; font-size: 12px; font-style: normal; font-variant-caps: normal; fo= nt-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-= indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spac= ing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-d= ecoration-thickness: auto; text-decoration-style: solid;"><span style=3D"car= et-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; fon= t-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing= : normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: n= one; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-= width: 0px; text-decoration: none; float: none; display: inline !important;"= >ADHD brain at work: I sometimes lose track of my inbox. Please feel free to= send a gentle nudge if you're waiting on a reply!</span><br style=3D"caret-= color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-s= tyle: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: n= ormal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none= ; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-wid= th: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-d= ecoration-style: solid;"><br style=3D"caret-color: rgb(0, 0, 0); font-family= : TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant-caps:= normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: s= tart; text-indent: 0px; text-transform: none; white-space: normal; widows: 2= ; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: n= one; text-decoration-thickness: auto; text-decoration-style: solid;"><span s= tyle=3D"caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-size= : 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; let= ter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-t= ransform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-t= ext-stroke-width: 0px; text-decoration: none; float: none; display: inline != important;">My working hours and your working hours may be different. Please= do not feel obligated to reply outside your normal working hours.</span><br= style=3D"caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; font-si= ze: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; l= etter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text= -transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit= -text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickne= ss: auto; text-decoration-style: solid;"><br style=3D"caret-color: rgb(0, 0,= 0); font-family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; fo= nt-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2= ; text-align: start; text-indent: 0px; text-transform: none; white-space: no= rmal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-dec= oration-line: none; text-decoration-thickness: auto; text-decoration-style: s= olid;"><blockquote type=3D"cite" style=3D"font-family: TimesNewRomanPSMT; fo= nt-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 4= 00; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px;= text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -w= ebkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-th= ickness: auto; text-decoration-style: solid;">On 21. 7. 2026, at 17:12, Ajay= Guleria via bind-users <<a href=3D"mailto:[email protected]">bind= [email protected]</a>> wrote:<br><br>Hello BIND Team,<br>We have deplo= yed automatic DNSSEC signing for a production authoritative zone using BIND 9= .18.39.<br>Environment<br> =E2=80=A2 BIND: 9.18.39<br> = ; =E2=80=A2 Zone type: Primary<br> =E2=80=A2 Con= figuration:<br> =E2=80=A2 inline-si= gning yes;<br> =E2=80=A2 dnssec-pol= icy "default";<br>rndc zonestatus reports:<br>serial: 2026072103<br>signed s= erial: 2026072300<br>inline signing: yes<br>key maintenance: automatic<br><b= r>DNSSEC validation is fully successful:<br>delv @8.8.8.8 example.com<br><br= >; fully validated<br><br>The DS record has been published at the parent, an= d validation succeeds using Google Public DNS and Cloudflare.<br>Observation= <br>The signed zone serial is maintained independently from the source zone s= erial.<br>For example:<br>Unsigned zone:<br>2026072103<br><br>Signed zone:<b= r>2026072300<br><br>After adding one DNS record:<br>Unsigned:<br>2026072103<= br><br>Signed:<br>2026072301<br><br>This behavior is consistent with the doc= umentation stating that the signed zone maintains its own SOA serial.<br>Ope= rational issue<br>Many widely used monitoring tools (MXToolbox, IntoDNS, DNS= Spy, and others) interpret the served SOA serial as a YYYYMMDDNN date-based= serial.<br>As a result, they report warnings such as:<br>SOA Serial Number = Format is Invalid<br><br>Serial: 2026072300<br><br>Serial date was 2026-07-2= 3 which is in the future.<br><br>Although DNSSEC validation is correct, thes= e warnings generate operational tickets and user concerns.<br>Questions<br>&= nbsp; 1. Is this independent signed serial expected behavior for B= IND 9.18.39 with dnssec-policy and inline-signing?<br> 2. I= s there any supported configuration that preserves the source SOA serial in t= he served signed zone while still allowing automatic signing and automatic k= ey maintenance?<br> 3. If not, would ISC consider adding an= optional configuration (for example, a policy or zone option) that allows t= he served signed zone to retain the source SOA serial where administrators i= ntentionally use YYYYMMDDNN serial numbering?<br>Thank you for any clarifica= tion.<br>--<span class=3D"Apple-converted-space"> </span><br>Visit<span= class=3D"Apple-converted-space"> </span><a href=3D"https://lists.isc.o= rg/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-= users</a><span class=3D"Apple-converted-space"> </span>to unsubscribe f= rom this list.<br></blockquote><br style=3D"caret-color: rgb(0, 0, 0); font-= family: TimesNewRomanPSMT; font-size: 12px; font-style: normal; font-variant= -caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-al= ign: start; text-indent: 0px; text-transform: none; white-space: normal; wid= ows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-l= ine: none; text-decoration-thickness: auto; text-decoration-style: solid;"><= span style=3D"caret-color: rgb(0, 0, 0); font-family: TimesNewRomanPSMT; fon= t-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 40= 0; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; t= ext-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -web= kit-text-stroke-width: 0px; text-decoration: none; float: none; display: inl= ine !important;">CAUTION: This email originated from outside of IIT Delhi. D= o not click links or open attachments unless you recognize the sender and kn= ow the content is safe.</span></div></blockquote></div><br></div></blockquot= e></div></div></div></body></html>= --Apple-Mail-3CA002CC-AE67-40F9-94E4-11E56EB37939-- --===============5123163483958167675== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list. --===============5123163483958167675==--