Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm testing key rollover with Dynamic Update. I'm using Bind 9.7.1-P2. When I change the key dates with the script dnssec-settime, named doesn´t update automatically the zone file unless I reload the service. Is this the normal behaviour??

Regards Arancha

share|improve this question

Do a "rndc sign zonename" to get named to notice your change.

share|improve this answer
The problem is if, for example, I change the Inactivation date of the current ZSK to now, and I also create a new ZSK with Activation date to now, the zone file gets signed by both ZSKs. And this is not the Pre-publication method that I would like to implement for a rollover. – Arancha Nov 4 '10 at 10:34
Sorry, this problem ocurred because I created the new ZSK with Publicaction and Activation date to now – Arancha Nov 4 '10 at 10:56
Is your zone set as "auto-dnssec maintain;" and are they keys for the zone available in the "key-directory" associated with the zone? I can't tell from your note above if you were able to solve the problem.. I've also been asked in another thread to admit that I work for ISC, the maintainers of BIND and ISC DHCP... :) – Knobee Nov 6 '10 at 1:11

I don't know anything about key rollovers but it is normal for named (and almost all other linux based daemons) not to do anything automatically involving their configs files unless you reload the service. You don't have to restart it, just tell it to reload the configs.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.