Geoff Huston - 2026-10-30 10:06:23
WHat we found was around 1,000 networks who choose to manually managed their trustyed key set.
Geoff Huston - 2026-10-30 10:07:13
Seems a bit risky to me, as you need to pay close attention to key roll timing if you are doing manaual trust management
Petra Zeidler - 2026-10-30 10:09:14
it may have been never revisited configuration from the time when you had to have trust anchors (and OSes that had that as default)
Geoff Huston - 2026-10-30 10:12:33
Alost all DNS packages are packaged with a trusted key set, and the idea is that you use the root DNSKEY RR to lean of new KSKs to trust. It suprises me that some operators turn off this form of automation.