I've found the following guide on how to setup DNSSEC with NSD DNS server and ldns utilities: https://www.digitalocean.com/community/tutorials/how-to-set-up-dnssec-on-an-nsd-nameserver-on-ubuntu-14-04
Basically it provides the following steps:
- Generate ZSK and KSK using ldns-keygen
- Sign the zone using ldns-signzone with above keys
- Point NSD to the signed version of zone file and reload config
- Write DS entries for the domain of subject on registrar panel
- Use provided script (dnszonesigner) whenever you change your zone (unsigned file)
And this all works fine. However there is a comment "Have you thought about how to keep the signed zone fresh? RRSIG's will expire and should be refreshed in time. In other words, a signed zone should be resigned every once in a while."
Is it a correct remark? I can't find information about DNSSEC zones staling anywhere. If it correct, should I just run dnszonesigner script via cron, if so, how frequently should I? What will happen (and when) if I don't do this? Will DNSSEC aware resolvers, like Google Public DNS still provide correct answers for the records in my zone?