Skip to content

Commit

Permalink
Merge pull request #15190 from jsoref/dnssec-migration
Browse files Browse the repository at this point in the history
docs: DNSSEC migration
  • Loading branch information
miodvallat authored Feb 21, 2025
2 parents efda0ac + c4bf236 commit 2a2919e
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions docs/dnssec/migration.rst
Original file line number Diff line number Diff line change
Expand Up @@ -89,16 +89,16 @@ KSK, use
pdnsutil import-zone-key ZONE FILENAME ksk
replace 'ksk' by 'zsk' for a Zone Signing Key.
replace ``ksk`` with ``zsk`` for a Zone Signing Key.

If all keys are imported using this tool, a zone will serve mostly
identical records to before, with the important change that the RRSIG
inception dates will be different.

.. note::
Within PowerDNS, the 'algorithm' for RSASHA1 keys is modulated
based on the NSEC3 setting. So if an algorithm=7 key is imported in a
zone with no configured NSEC3, it will appear as algorithm 5!
Within PowerDNS, the ``algorithm`` for RSASHA1 keys is modulated
based on the NSEC3 setting. So if an ``algorithm=7`` key is imported in a
zone with no configured NSEC3, it will appear as ``algorithm 5``!

Secure transfers
----------------
Expand Down

0 comments on commit 2a2919e

Please sign in to comment.