Didn't expect that but dnssec-rr of mforney allowing to sign for arbitrary dates (like 10 years) made me want to try DNSSEC again, although on a spare domain for now to see how it fares (in fact might inject bugs just to see how bad debugging dnssec issues probably still is…).
OVH is still crap though, with apparently having to insert the pubkey as written for the DNSKEY record for registering a DS record…
screen.png
0 Boosts
0 Likes
Typical signature timespan done by DNSSEC signing tools being 30 days, which is part of why I gave up on it ~10 years ago, because worst case it means issues every 30 days or so with basically no simple tool (like say dig/drill, not SaaS stuff like dnsviz.net) capable of pointing at the problem.
Meanwhile consider that when TLS, SSH, … fails you get proper error messages, heck even gpg(1) is typically capable of that.
@lanodan yeah, seeing how far mcf has gone with BearSSL and DNSSEC motivates me to learn how this all works and master these tools.
Not this month though. This month is 😴