Seeking Advice on DNSSEC Algorithm Rollover

[Tony Finch]

Spain, Dr. Jeffry A. <spainj at countryday.net> wrote:
>
> My experience with changing the timing metadata or removing the key
> files is that named issues a warning like the following: zone <zone>/IN:
> Key <zone>/<algorithm>/<key tag> missing or inactive and has no
> replacement: retaining signatures. In this circumstance none of the
> RRSIGs or NSECs are removed. They sit there indefinitely even after the
> RRSIGs expire.

If I remember correctly, that was because you removed the keyfile rather
than just updating the timing metadata. Try updating the timing data and
leaving the keyfiles in place until after BIND has acted on the deletion
date.

Tony.
-- 
f.anthony.n.finch  <dot at dotat.at>  http://dotat.at/
Forties: Northwesterly 4 or 5, occasionally 6 in east. Slight or moderate,
occasionally rough later. Mainly fair. Moderate or good.