Trust anchor e rollover automatizzato

Trust anchors and automated rollover

A rollover is not “change one key and hope the internet catches up.” Resolvers and parent zones may cache data for different periods. The root trust anchor can be managed with an automated process. At a delegation, CDS and CDNSKEY let a child publish information that may help its parent update the DS, subject to the parent’s policy.

Automation reduces manual work but does not remove the need for checks, authorization, and rollback. Confirm the algorithm and digest, match DS to DNSKEY, check signature state, and account for cache windows before and after the change.

A careful procedure states its preconditions, publishes the new key, allows propagation, updates the parent, verifies the result from independent resolvers, and removes the old key only when the transition is complete. Follow your registrar and DNS software’s supported process rather than copying commands blindly.

References: RFC 5011 — automated trust-anchor management · RFC 7344 — CDS/CDNSKEY · RFC 8078 — DS update

Check your understanding

Choose the best answer. The examples use training names and do not send real DNS queries.

Quiz#dns.m13.l2.e1

What must remain true during a rollover?

Parent and child must keep a verifiable link during the transitionThe DS may point to a key that was never publishedEvery cache updates at the same instant