Rotating Keys with Ds Record

Question

Hi Team,
If a user is utilizing a DS (Delegation Signer) record in multiple places and a KSK (Key Signing Key) rotation is required, what precautions or steps should be taken to ensure that this rotation does not adversely affect the DS records? Are there any best practices or specific workflows to minimize the impact during this process?

Looking forward to your guidance.

Shreevar_L · Answer

Assuming that the KSK that is being rotated has been added to the TLD hosted zone previously and is currently in use to enable DNSSEC for your 2nd Level domain.

The steps to rotate KSK are documented at [1]

Here is a summary of the steps:

1. Create a new KSK and Activate it. Make sure status is Active.
2. Establish a chain of trust with it by adding (not replacing) the DS record to the parent TLD hosted zone. At the end of this step there will be 2 DS records in the parent TLD hosted zone.
3. Determine the time to live (TTL) values for the DNSKEY and DS records associated with the original KSK (the one you’re replacing).
4. Wait for the maximum of the 2 TTLs noted in Step 3.
5. Remove the old DS record from the parent TLD hosted zone.
6. Deactivate and delete the original KSK.

For detailed step by step guidance please refer to [1]

[1] https://aws.amazon.com/blogs/networking-and-content-delivery/configuring-dnssec-signing-and-validation-with-amazon-route-53/

Rotating Keys with Ds Record

Add your answer

Relevant content