模块课程（3/3）
Scadenze e recupero
Expiration and recovery
Expired signatures, a stale DS, or a key mismatch can cause validating resolvers to reject otherwise reachable DNS data. Start by preserving evidence: record the query, resolver, response code, time, and validation status. Compare the DS in the parent with DNSKEY data in the child, then check signature validity and consistency across authoritative servers.
Correct the broken link with the smallest controlled change. Monitor from independent validating resolvers and wait for relevant caches to age out. Do not remove DNSSEC blindly or make several key changes at once; those steps can widen the outage or erase clues.
For a suspected stale DS, compare parent DS and child DNSKEY, then inspect signatures and cache timing. Prepare an incident runbook before a rollover, not during one.
Check your understanding
Choose the best answer. This quiz runs locally and sends no DNS queries to real domains.
For a suspected stale DS, which data should you compare?