Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A disaster recovery plan has been proposed in a client's company that would fail back from DNSSec to regular DNS in the event of

1) A major site outage requiring the change of many DNS records

2) An issue with DNSSec that justifies a failback

3) An issue with our Tier 1 DNSSec provider

Is there any foreseeable issues when failing back a functional DNSSec implementation to "regular" DNS?

share|improve this question
1) Does failing back to DNS from DNSSEC in your plans include removal of DS records for your domain from the parent domain? 2) Do child domains of your domain rely on it to be signed? – nearora Jun 6 '12 at 1:05
I'm new to DNSSec so any logical checks would be helpful. Thank you @nearora – LamonteCristo Jun 6 '12 at 1:13
One of the places I worked we did an evaluation of DNSSEC. It took a team of six approximately three months to figure out most questions and work out answers. We didn't get around to doing an implementation beyond a limited test environment. My recollection is that we predicted it would take a good six months to do all the tests that we wanted to do before making final recommendations. It's neither easy, nor small and has far reaching implications depending on how critical DNS infrastructure is to your business. – nearora Jun 6 '12 at 1:26
I'd really be interested in learning from your questions, answers, and lessons learned. Do you have a blog, Word doc, or anything I could build upon and share back with you? – LamonteCristo Jun 6 '12 at 1:30
I just tried to find out and there isn't a public version available. If you check with RIPE NCC, Nominet, and others that have implemented DNSSEC, you'll be able to get your hands on documents such as and to start you off. – nearora Jun 6 '12 at 1:35

The main issue with unsigning your zone is that DS records should be removed from parent zone well in advance before you unsign your zone - you should wait for those records to expire from caches before you remove your DNSKEYs and RRSIGs. If some cache for some reason keeps DS records, he will refuse to use your unsigned zone at all.

Additionally, if you (i.e. resolvers which query your zone) use DLV, your zone should be removed from DLV too. Today nobody supposed to use DLV. IMHO.

It is about the same in the "regular" DNS - when you want to change a nameservers, you remove old nameservers only after NS TTL to expires.

The biggest problem with DNSSEC is that people think that it's something extremely complex. IMHO. DNSSEC is no more complicated than DNS and SSL, and everybody uses the two, not even knowing that they are complicated.

share|improve this answer
+1 for the last line. Besides which, in a DR circumstance you risk goes up. There are plenty of opportunists to disasters, starting with fake charities. I can imagine this as a greater opportunity for malicious acts. – Jeff Ferland Jun 6 '12 at 17:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.