DNSSEC lifecycle report

dnslab.us

Time window
earliest → now
Generated
2026-04-13T04:49:51.152534+00:00
Key directory
/mnt/bind/keys/dnslab.us

Summary

During the reported window 10 DNS observation(s).

Key inventory

TagRoleAlgorithmKey idFirst seen
12022 KSK 14 Kdnslab.us.+014+12022 2026-04-11T11:03:18Z
57017 KSK 14 Kdnslab.us.+014+57017 2026-04-11T11:03:18Z
8119 ZSK 14 Kdnslab.us.+014+08119 2026-04-11T11:03:18Z
26424 ZSK 14 Kdnslab.us.+014+26424 2026-04-11T11:03:18Z

Rollover view

Every observed key on a time axis, grouped by (role, algorithm), with phase-coloured bars (pre-publication / published / active / retired / removed). A thin DS overlay stripe above each KSK row shows when the parent-side chain of trust was actually complete, which is often when the interesting DNSSEC stories happen. If two algorithms are simultaneously active, the overlap region is highlighted behind their bars.

2026-04-11 11:03 → 2026-04-13 04:49 UTC04-11 11:0304-11 16:1604-11 21:2904-12 02:4304-12 07:5604-12 13:0904-12 18:2304-12 23:3604-13 04:49KSK · alg 14ZSK · alg 14tag 12022KSK tag 12022 alg 14 — active signing DNSKEY / zone data 2026-04-11 11:03 → 2026-04-13 04:49 UTCactiveDS observed at parent 2026-04-11 11:03 → 2026-04-13 04:49 UTCDStag 57017KSK tag 57017 alg 14 — past-deletion-date past scheduled delete time — should no longer be in the zone 2026-04-11 11:03 → 2026-04-13 04:49 UTCpast deletion dateDStag 8119ZSK tag 8119 alg 14 — active signing DNSKEY / zone data 2026-04-11 11:03 → 2026-04-13 04:49 UTCactivetag 26424ZSK tag 26424 alg 14 — past-deletion-date past scheduled delete time — should no longer be in the zone 2026-04-11 11:03 → 2026-04-13 04:49 UTCpast deletion datenowpre-publicationpublishedactiveto be deletedpast deletion date

Calendar view

Monthly calendars covering the reported window. Each day is shaded by the number of events observed and carries a coloured dot for every event source that fired that day. Hover any day for the count and a sample of the events (live UI only).

on-disk staterndc dnssec -statusDNS probeK*.key timingiodyn / syslognamed.logscheduled (from K*.key)today
October 2024
MonTueWedThuFriSatSun
30123456
78910111213
14151617181920
21222324252627
28293031123
November 2024
MonTueWedThuFriSatSun
28293031123
45678910
11121314151617
18192021222324
2526272829301
December 2024
MonTueWedThuFriSatSun
2526272829301
2345678
9101112131415
16171819202122
23242526272829
303112345
January 2025
MonTueWedThuFriSatSun
303112345
6789101112
13141516171819
20212223242526
272829303112
February 2025
MonTueWedThuFriSatSun
272829303112
3456789
10111213141516
17181920212223
242526272812
March 2025
MonTueWedThuFriSatSun
242526272812
3456789
10111213141516
17181920212223
24252627282930
31123456
April 2025
MonTueWedThuFriSatSun
31123456
78910111213
14151617181920
21222324252627
2829301234
May 2025
MonTueWedThuFriSatSun
2829301234
567891011
12131415161718
19202122232425
2627282930311
June 2025
MonTueWedThuFriSatSun
2627282930311
2345678
9101112131415
16171819202122
23242526272829
30123456
July 2025
MonTueWedThuFriSatSun
30123456
78910111213
14151617181920
21222324252627
28293031123
August 2025
MonTueWedThuFriSatSun
28293031123
45678910
11121314151617
18192021222324
25262728293031
September 2025
MonTueWedThuFriSatSun
1234567
891011121314
15161718192021
22232425262728
293012345
October 2025
MonTueWedThuFriSatSun
293012345
6789101112
13141516171819
20212223242526
272829303112
November 2025
MonTueWedThuFriSatSun
272829303112
3456789
10111213141516
17181920212223
24252627282930
December 2025
MonTueWedThuFriSatSun
1234567
891011121314
15161718192021
22232425262728
2930311234
January 2026
MonTueWedThuFriSatSun
2930311234
567891011
12131415161718
19202122232425
2627282930311
February 2026
MonTueWedThuFriSatSun
2627282930311
2345678
9101112131415
16171819202122
2324252627281
March 2026
MonTueWedThuFriSatSun
2324252627281
2345678
9101112131415
16171819202122
23242526272829
303112345
April 2026
MonTueWedThuFriSatSun
303112345
6789101112
13141516171819
20212223242526
27282930123
May 2026
MonTueWedThuFriSatSun
27282930123
45678910
11121314151617
18192021222324
25262728293031
June 2026
MonTueWedThuFriSatSun
1234567
891011121314
15161718192021
22232425262728
293012345
July 2026
MonTueWedThuFriSatSun
293012345
6789101112
13141516171819
20212223242526
272829303112
August 2026
MonTueWedThuFriSatSun
272829303112
3456789
10111213141516
17181920212223
24252627282930
31123456
September 2026
MonTueWedThuFriSatSun
31123456
78910111213
14151617181920
21222324252627
2829301234
October 2026
MonTueWedThuFriSatSun
2829301234
567891011
12131415161718
19202122232425
2627282930311

DNS event timeline

Events observed via live DNS queries and reported by rndc dnssec -status. Dots are coloured by source, stacked to avoid overlap, and the significant transitions are labelled inline.

2026-04-11T11:03:18+00:00 → 2026-04-11T13:03:17+00:0011:0311:1811:3311:4812:0312:1812:3312:4813:0311:03:18 [dns] dns_dnskey_appeared_at_zone: DNSKEY (key tag 8119) appeared at zone for dnslab.us 11:03:18 [dns] dns_dnskey_appeared_at_zone: DNSKEY (key tag 12022) appeared at zone for dnslab.us 11:03:18 [dns] dns_soa_appeared_at_zone: SOA observed at zone for dnslab.us (serial 2018113535) 11:03:18 [dns] dns_cds_appeared_at_zone: CDS (key tag 12022) appeared at zone for dnslab.us 11:03:18 [dns] dns_cdnskey_appeared_at_zone: CDNSKEY (key tag 12022) appeared at zone for dnslab.us 11:03:19 [rndc] rndc_first_observation: dnslab.us: observed 4 key(s) via rndc 11:03:19 [dns] dns_ds_appeared_at_parent: DS (key tag 12022) appeared at parent for dnslab.us713:03:17 [dns] dns_rrsig_appeared_at_zone: RRSIG over CDNSKEY (key tag 12022) appeared at zone for dnslab.us 13:03:17 [dns] dns_rrsig_appeared_at_zone: RRSIG over CDS (key tag 12022) appeared at zone for dnslab.us 13:03:17 [dns] dns_rrsig_appeared_at_zone: RRSIG over DNSKEY (key tag 12022) appeared at zone for dnslab.us 13:03:17 [dns] dns_rrsig_appeared_at_zone: RRSIG over SOA (key tag 8119) appeared at zone for dnslab.us4dnsrndc

File event timeline

Changes observed directly on disk — every modification to a K*.state or K*.key file. Paired with the DNS timeline above, divergence between the two channels is usually where the interesting DNSSEC bugs live.

2026-04-11T11:03:18+00:00 → 2026-04-11T11:04:18+00:0011:0311:0311:0311:0311:0311:0311:0411:0411:0411:03:18 [state] state_key_observed: new K*.state for dnslab.us ZSK tag=8119 11:03:18 [state] state_key_observed: new K*.state for dnslab.us ZSK tag=26424 11:03:18 [state] state_key_observed: new K*.state for dnslab.us KSK tag=57017 11:03:18 [state] state_key_observed: new K*.state for dnslab.us KSK tag=12022 11:03:18 [key] key_file_observed: new K*.key for dnslab.us KSK tag=57017 11:03:18 [key] key_file_observed: new K*.key for dnslab.us KSK tag=12022 11:03:18 [key] key_file_observed: new K*.key for dnslab.us ZSK tag=8119 11:03:18 [key] key_file_observed: new K*.key for dnslab.us ZSK tag=264248statekey

State machine timeline

Colour bars show each key's state-machine value over the window. Separate lanes for GoalState, DNSKEYState, KRRSIGState, ZRRSIGState, and DSState. The rndc view is drawn below from rndc dnssec -status; discrepancies between the two are where bugs and BIND quirks usually live.

No state transitions recorded in this window.

BIND's view (rndc dnssec -status)

No rndc state transitions recorded in this window.

Chronological event log

2026-04-11

TimeSourceKeyTypeSummary
11:03:18Z state ZSK 8119 state_key_observed new K*.state for dnslab.us ZSK tag=8119
11:03:18Z state ZSK 26424 state_key_observed new K*.state for dnslab.us ZSK tag=26424
11:03:18Z state KSK 57017 state_key_observed new K*.state for dnslab.us KSK tag=57017
11:03:18Z state KSK 12022 state_key_observed new K*.state for dnslab.us KSK tag=12022
11:03:18Z key KSK 57017 key_file_observed new K*.key for dnslab.us KSK tag=57017
11:03:18Z key KSK 12022 key_file_observed new K*.key for dnslab.us KSK tag=12022
11:03:18Z key ZSK 8119 key_file_observed new K*.key for dnslab.us ZSK tag=8119
11:03:18Z key ZSK 26424 key_file_observed new K*.key for dnslab.us ZSK tag=26424
11:03:18Z dns 8119 dns_dnskey_appeared_at_zone DNSKEY (key tag 8119) appeared at zone for dnslab.us
11:03:18Z dns 12022 dns_dnskey_appeared_at_zone DNSKEY (key tag 12022) appeared at zone for dnslab.us
11:03:18Z dns dns_soa_appeared_at_zone SOA observed at zone for dnslab.us (serial 2018113535)
11:03:18Z dns 12022 dns_cds_appeared_at_zone CDS (key tag 12022) appeared at zone for dnslab.us
11:03:18Z dns 12022 dns_cdnskey_appeared_at_zone CDNSKEY (key tag 12022) appeared at zone for dnslab.us
11:03:19Z rndc rndc_first_observation dnslab.us: observed 4 key(s) via rndc
11:03:19Z dns 12022 dns_ds_appeared_at_parent DS (key tag 12022) appeared at parent for dnslab.us
13:03:17Z dns 12022 dns_rrsig_appeared_at_zone RRSIG over CDNSKEY (key tag 12022) appeared at zone for dnslab.us
13:03:17Z dns 12022 dns_rrsig_appeared_at_zone RRSIG over CDS (key tag 12022) appeared at zone for dnslab.us
13:03:17Z dns 12022 dns_rrsig_appeared_at_zone RRSIG over DNSKEY (key tag 12022) appeared at zone for dnslab.us
13:03:17Z dns 8119 dns_rrsig_appeared_at_zone RRSIG over SOA (key tag 8119) appeared at zone for dnslab.us

Per-key breakdown

For every observed key: the current K*.key timings and K*.state fields captured at report time, plus a calendar and split DNS / File timelines limited to that key's events. KSKs naturally show their DS lifecycle at the parent because DS events are tagged by key tag at emit time.

KSK · tag 12022

Algorithm: 14 · Key id: Kdnslab.us.+014+12022 · First seen: 2026-04-11T11:03:18Z

K*.key file timings
FieldValue
Created2025-10-22 20:56:30 UTC
Publish2025-10-22 20:56:30 UTC
Activate2025-10-22 22:11:30 UTC
Revoke—
Inactive2026-10-22 22:11:30 UTC
Delete2026-10-24 00:11:30 UTC
SyncPublish2025-10-22 22:11:30 UTC
SyncDelete—
K*.state — state machine
FieldValue
GoalStateomnipresent
DNSKEYStateomnipresent
KRRSIGStateomnipresent
DSStateomnipresent
K*.state — timestamps
FieldValue
Generated20251022205630 (Wed Oct 22 20:56:30 2025)
Published20251022205630 (Wed Oct 22 20:56:30 2025)
Active20251022221130 (Wed Oct 22 22:11:30 2025)
Retired20261022221130 (Thu Oct 22 22:11:30 2026)
Removed20261024001130 (Sat Oct 24 00:11:30 2026)
DNSKEYChange20251022221130 (Wed Oct 22 22:11:30 2025)
KRRSIGChange20251022221130 (Wed Oct 22 22:11:30 2025)
DSChange20251030131900 (Thu Oct 30 13:19:00 2025)
DSPublish20251029111900 (Wed Oct 29 11:19:00 2025)
PublishCDS20251022221130 (Wed Oct 22 22:11:30 2025)

Calendar

on-disk staterndc dnssec -statusDNS probeK*.key timingiodyn / syslognamed.logscheduled (from K*.key)today
April 2026
MonTueWedThuFriSatSun
303112345
6789101112
13141516171819
20212223242526
27282930123

DNS events for this key

2026-04-11T11:03:18+00:00 → 2026-04-11T13:03:17+00:0011:0311:1811:3311:4812:0312:1812:3312:4813:0311:03:18 [dns] dns_dnskey_appeared_at_zone: DNSKEY (key tag 12022) appeared at zone for dnslab.us 11:03:18 [dns] dns_cds_appeared_at_zone: CDS (key tag 12022) appeared at zone for dnslab.us 11:03:18 [dns] dns_cdnskey_appeared_at_zone: CDNSKEY (key tag 12022) appeared at zone for dnslab.us 11:03:19 [dns] dns_ds_appeared_at_parent: DS (key tag 12022) appeared at parent for dnslab.us413:03:17 [dns] dns_rrsig_appeared_at_zone: RRSIG over CDNSKEY (key tag 12022) appeared at zone for dnslab.us 13:03:17 [dns] dns_rrsig_appeared_at_zone: RRSIG over CDS (key tag 12022) appeared at zone for dnslab.us 13:03:17 [dns] dns_rrsig_appeared_at_zone: RRSIG over DNSKEY (key tag 12022) appeared at zone for dnslab.us3dns

File events for this key

2026-04-11T11:03:18+00:00 → 2026-04-11T11:04:18+00:0011:0311:0311:0311:0311:0311:0311:0411:0411:0411:03:18 [state] state_key_observed: new K*.state for dnslab.us KSK tag=12022 11:03:18 [key] key_file_observed: new K*.key for dnslab.us KSK tag=120222statekey

KSK · tag 57017

Algorithm: 14 · Key id: Kdnslab.us.+014+57017 · First seen: 2026-04-11T11:03:18Z

K*.key file timings
FieldValue
Created2024-10-22 22:11:30 UTC
Publish2024-10-22 22:11:30 UTC
Activate2024-10-22 22:11:30 UTC
Revoke—
Inactive2025-10-22 22:11:30 UTC
Delete2025-10-24 00:11:30 UTC
SyncPublish2024-10-23 23:16:30 UTC
SyncDelete—
K*.state — state machine
FieldValue
GoalStatehidden
DNSKEYStatehidden
KRRSIGStatehidden
DSStateunretentive
K*.state — timestamps
FieldValue
Generated20241022221130 (Tue Oct 22 22:11:30 2024)
Published20241022221130 (Tue Oct 22 22:11:30 2024)
Active20241022221130 (Tue Oct 22 22:11:30 2024)
Retired20251022221130 (Wed Oct 22 22:11:30 2025)
Removed20251024001130 (Fri Oct 24 00:11:30 2025)
DNSKEYChange20251030133400 (Thu Oct 30 13:34:00 2025)
KRRSIGChange20251030133400 (Thu Oct 30 13:34:00 2025)
DSChange20251022221130 (Wed Oct 22 22:11:30 2025)
PublishCDS20241023231630 (Wed Oct 23 23:16:30 2024)

Calendar

on-disk staterndc dnssec -statusDNS probeK*.key timingiodyn / syslognamed.logscheduled (from K*.key)today
April 2026
MonTueWedThuFriSatSun
303112345
6789101112
13141516171819
20212223242526
27282930123

DNS events for this key

No events in the reported window.

File events for this key

2026-04-11T11:03:18+00:00 → 2026-04-11T11:04:18+00:0011:0311:0311:0311:0311:0311:0311:0411:0411:0411:03:18 [state] state_key_observed: new K*.state for dnslab.us KSK tag=57017 11:03:18 [key] key_file_observed: new K*.key for dnslab.us KSK tag=570172statekey

ZSK · tag 8119

Algorithm: 14 · Key id: Kdnslab.us.+014+08119 · First seen: 2026-04-11T11:03:18Z

K*.key file timings
FieldValue
Created2026-02-14 20:56:30 UTC
Publish2026-02-14 20:56:30 UTC
Activate2026-02-14 22:11:30 UTC
Revoke—
Inactive2026-04-15 22:11:30 UTC
Delete2026-04-25 23:16:30 UTC
SyncPublish—
SyncDelete—
K*.state — state machine
FieldValue
GoalStateomnipresent
DNSKEYStateomnipresent
ZRRSIGStateomnipresent
K*.state — timestamps
FieldValue
Generated20260214205630 (Sat Feb 14 20:56:30 2026)
Published20260214205630 (Sat Feb 14 20:56:30 2026)
Active20260214221130 (Sat Feb 14 22:11:30 2026)
Retired20260415221130 (Wed Apr 15 22:11:30 2026)
Removed20260425231630 (Sat Apr 25 23:16:30 2026)
DNSKEYChange20260214221130 (Sat Feb 14 22:11:30 2026)
ZRRSIGChange20260224231630 (Tue Feb 24 23:16:30 2026)

Calendar

on-disk staterndc dnssec -statusDNS probeK*.key timingiodyn / syslognamed.logscheduled (from K*.key)today
April 2026
MonTueWedThuFriSatSun
303112345
6789101112
13141516171819
20212223242526
27282930123

DNS events for this key

2026-04-11T11:03:18+00:00 → 2026-04-11T13:03:17+00:0011:0311:1811:3311:4812:0312:1812:3312:4813:032026-04-11T11:03:18Z [dns] dns_dnskey_appeared_at_zone DNSKEY (key tag 8119) appeared at zone for dnslab.usdnskey_appeared_at_zone2026-04-11T13:03:17Z [dns] dns_rrsig_appeared_at_zone RRSIG over SOA (key tag 8119) appeared at zone for dnslab.usdns

File events for this key

2026-04-11T11:03:18+00:00 → 2026-04-11T11:04:18+00:0011:0311:0311:0311:0311:0311:0311:0411:0411:0411:03:18 [state] state_key_observed: new K*.state for dnslab.us ZSK tag=8119 11:03:18 [key] key_file_observed: new K*.key for dnslab.us ZSK tag=81192statekey

ZSK · tag 26424

Algorithm: 14 · Key id: Kdnslab.us.+014+26424 · First seen: 2026-04-11T11:03:18Z

K*.key file timings
FieldValue
Created2025-12-16 20:56:30 UTC
Publish2025-12-16 20:56:30 UTC
Activate2025-12-16 22:11:30 UTC
Revoke—
Inactive2026-02-14 22:11:30 UTC
Delete2026-02-24 23:16:30 UTC
SyncPublish—
SyncDelete—
K*.state — state machine
FieldValue
GoalStatehidden
DNSKEYStatehidden
ZRRSIGStatehidden
K*.state — timestamps
FieldValue
Generated20251216205630 (Tue Dec 16 20:56:30 2025)
Published20251216205630 (Tue Dec 16 20:56:30 2025)
Active20251216221130 (Tue Dec 16 22:11:30 2025)
Retired20260214221130 (Sat Feb 14 22:11:30 2026)
Removed20260224231630 (Tue Feb 24 23:16:30 2026)
DNSKEYChange20260224233130 (Tue Feb 24 23:31:30 2026)
ZRRSIGChange20260224231630 (Tue Feb 24 23:16:30 2026)

Calendar

on-disk staterndc dnssec -statusDNS probeK*.key timingiodyn / syslognamed.logscheduled (from K*.key)today
April 2026
MonTueWedThuFriSatSun
303112345
6789101112
13141516171819
20212223242526
27282930123

DNS events for this key

No events in the reported window.

File events for this key

2026-04-11T11:03:18+00:00 → 2026-04-11T11:04:18+00:0011:0311:0311:0311:0311:0311:0311:0411:0411:0411:03:18 [state] state_key_observed: new K*.state for dnslab.us ZSK tag=26424 11:03:18 [key] key_file_observed: new K*.key for dnslab.us ZSK tag=264242statekey

DNS observations

Samples of what was visible at the zone and at the parent.

WhenWhereTypeChange
2026-04-11T11:03:18Z zone DNSKEY DNSKEY (key tag 8119) appeared at zone for dnslab.us
2026-04-11T11:03:18Z zone DNSKEY DNSKEY (key tag 12022) appeared at zone for dnslab.us
2026-04-11T11:03:18Z zone SOA SOA observed at zone for dnslab.us (serial 2018113535)
2026-04-11T11:03:18Z zone CDS CDS (key tag 12022) appeared at zone for dnslab.us
2026-04-11T11:03:18Z zone CDNSKEY CDNSKEY (key tag 12022) appeared at zone for dnslab.us
2026-04-11T11:03:19Z parent DS DS (key tag 12022) appeared at parent for dnslab.us
2026-04-11T13:03:17Z zone RRSIG RRSIG over CDNSKEY (key tag 12022) appeared at zone for dnslab.us
2026-04-11T13:03:17Z zone RRSIG RRSIG over CDS (key tag 12022) appeared at zone for dnslab.us
2026-04-11T13:03:17Z zone RRSIG RRSIG over DNSKEY (key tag 12022) appeared at zone for dnslab.us
2026-04-11T13:03:17Z zone RRSIG RRSIG over SOA (key tag 8119) appeared at zone for dnslab.us

Appendix — raw state snapshots

KSK tag=12022

Active: 20251022221130 (Wed Oct 22 22:11:30 2025)
DNSKEYChange: 20251022221130 (Wed Oct 22 22:11:30 2025)
DNSKEYState: omnipresent
DSChange: 20251030131900 (Thu Oct 30 13:19:00 2025)
DSPublish: 20251029111900 (Wed Oct 29 11:19:00 2025)
DSState: omnipresent
Generated: 20251022205630 (Wed Oct 22 20:56:30 2025)
GoalState: omnipresent
KRRSIGChange: 20251022221130 (Wed Oct 22 22:11:30 2025)
KRRSIGState: omnipresent
PublishCDS: 20251022221130 (Wed Oct 22 22:11:30 2025)
Published: 20251022205630 (Wed Oct 22 20:56:30 2025)
Removed: 20261024001130 (Sat Oct 24 00:11:30 2026)
Retired: 20261022221130 (Thu Oct 22 22:11:30 2026)

KSK tag=57017

Active: 20241022221130 (Tue Oct 22 22:11:30 2024)
DNSKEYChange: 20251030133400 (Thu Oct 30 13:34:00 2025)
DNSKEYState: hidden
DSChange: 20251022221130 (Wed Oct 22 22:11:30 2025)
DSState: unretentive
Generated: 20241022221130 (Tue Oct 22 22:11:30 2024)
GoalState: hidden
KRRSIGChange: 20251030133400 (Thu Oct 30 13:34:00 2025)
KRRSIGState: hidden
PublishCDS: 20241023231630 (Wed Oct 23 23:16:30 2024)
Published: 20241022221130 (Tue Oct 22 22:11:30 2024)
Removed: 20251024001130 (Fri Oct 24 00:11:30 2025)
Retired: 20251022221130 (Wed Oct 22 22:11:30 2025)

ZSK tag=8119

Active: 20260214221130 (Sat Feb 14 22:11:30 2026)
DNSKEYChange: 20260214221130 (Sat Feb 14 22:11:30 2026)
DNSKEYState: omnipresent
Generated: 20260214205630 (Sat Feb 14 20:56:30 2026)
GoalState: omnipresent
Published: 20260214205630 (Sat Feb 14 20:56:30 2026)
Removed: 20260425231630 (Sat Apr 25 23:16:30 2026)
Retired: 20260415221130 (Wed Apr 15 22:11:30 2026)
ZRRSIGChange: 20260224231630 (Tue Feb 24 23:16:30 2026)
ZRRSIGState: omnipresent

ZSK tag=26424

Active: 20251216221130 (Tue Dec 16 22:11:30 2025)
DNSKEYChange: 20260224233130 (Tue Feb 24 23:31:30 2026)
DNSKEYState: hidden
Generated: 20251216205630 (Tue Dec 16 20:56:30 2025)
GoalState: hidden
Published: 20251216205630 (Tue Dec 16 20:56:30 2025)
Removed: 20260224231630 (Tue Feb 24 23:16:30 2026)
Retired: 20260214221130 (Sat Feb 14 22:11:30 2026)
ZRRSIGChange: 20260224231630 (Tue Feb 24 23:16:30 2026)
ZRRSIGState: hidden