search

desec-io / desec-stack

Backbone of the deSEC Free Secure DNS Hosting Service
https://desec.io/
MIT License
391 stars 49 forks source link

replication: include DNSKEY in the replication state variable (not only SOA serial) #418

Open peterthomassen opened 4 years ago

peterthomassen commented 4 years ago

If a zone with a high serial (~ "made a few changes today") is deleted and recreated quickly, the SOA serial can end up being lower or equal on the primary than on the secondary nameservers. This may obstruct replication, and the zone is stuck publicly with an old DNSKEY.

To make this work correctly, also trigger replication whenever DNSKEY has changed (i.e. include it in a hash along with the serial, or something like that).

peterthomassen commented 4 years ago

Also, consider using https://doc.powerdns.com/authoritative/settings.html#axfr-lower-serial