[dnssec-deployment] SEPs and TARs

[Matthijs Mekking]

Paul Hoffman wrote:
> (c) We never get here. FreeResolver was checking the freshness every day and understands RFC 5011. When it saw K2, it loaded it permanently as an SEP.

To clarify, RFC 5011 does not prevent SERVFAILing a zone that does not
properly roll over their keys. If it saw K2 and K1 was already retired
from the zone, K2 is not loaded permanently as a trust anchor.

Matthijs

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 544 bytes
Desc: OpenPGP digital signature
Url : http://dnssec-deployment.org/pipermail/dnssec-deployment/attachments/20090401/45e6b570/attachment.bin