[ksk-rollover] Revoked KSK-2010 now gone [was: Increased DNSKEY queries to the root servers since the KSK-2010 revocation]

[Matt Larson]

On Mar 22, 2019, at 12:54 PM, Chris Thompson <cet1 at cam.ac.uk<mailto:cet1 at cam.ac.uk>> wrote:

I see the revoked KSK-2010 has gone from the root servers on schedule
(as of SOA serial 2019032200<tel:2019032200>).

It should be interesting to see whether the DNSKEY query rate to the
root servers (1) increases even more (2) falls off now (3) stays much
the same. That might give us a whole 1.58 bits of clue as to the cause
of the increase in the first place... :-)

The root zone without KSK-2010 went out ~1440 UTC. We've already seen a massive drop in DNSKEY queries from everywhere we have data. Note the graph below.

Matt


[cid:5ECC30BA-3FDF-4B27-B657-714849412377]
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mm.icann.org/pipermail/ksk-rollover/attachments/20190322/a5c26ddd/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PastedGraphic-5.png
Type: image/png
Size: 95935 bytes
Desc: PastedGraphic-5.png
URL: <http://mm.icann.org/pipermail/ksk-rollover/attachments/20190322/a5c26ddd/PastedGraphic-5-0001.png>