[ksk-rollover] Increased DNSKEY queries to the root servers since the KSK-2010 revocation

Roy Arends roy at dnss.ec
Tue Feb 12 17:12:35 UTC 2019

I gave a presentation on this at FOSDEM.


There is still no decline. There is a slight increase since the revoke.


> On 12 Feb 2019, at 16:52, Chris Thompson <cet1 at cam.ac.uk> wrote:
> On Jan 15 2019, Paul Hoffman wrote:
>> Greetings again. Soon after the new DNSKEY RRset was published at 1400 UTC
>> on 11 January 2019 with KSK-2010 revoked, there was a noticeable increase
>> in ./IN/DNSKEY queries sent to root servers.
> [much detail omitted here]
>> The ICANN organization is evaluating the traffic at the L-root to try to
>> characterize the resolvers that are rapidly asking for the root's DNSKEY
>> RRset. From this, we can determine if we are able to help the operators
>> of those resolvers to remediate this anomalous behavior. We will also
>> share data with other root server operators who are conducting similar
>> investigations. The results will be reported when our analysis is complete.
> A month on, is there anything more known about this? In particular, for
> how long did the increased DNSKEY query rate continue?
> -- 
> Chris Thompson
> Email: cet1 at cam.ac.uk
> _______________________________________________
> ksk-rollover mailing list
> ksk-rollover at icann.org
> https://mm.icann.org/mailman/listinfo/ksk-rollover

More information about the ksk-rollover mailing list