DNSSEC lifecycle report

Key inventory

Rollover view

Every observed key on a time axis, grouped by (role, algorithm), with phase-coloured bars (pre-publication / published / active / retired / removed). A thin DS overlay stripe above each KSK row shows when the parent-side chain of trust was actually complete, which is often when the interesting DNSSEC stories happen. If two algorithms are simultaneously active, the overlap region is highlighted behind their bars.

Calendar view

Monthly calendars covering the reported window. Each day is shaded by the number of events observed and carries a coloured dot for every event source that fired that day. Hover any day for the count and a sample of the events (live UI only).

DNS event timeline

Events observed via live DNS queries and reported by rndc dnssec -status. Dots are coloured by source, stacked to avoid overlap, and the significant transitions are labelled inline.

File event timeline

Changes observed directly on disk — every modification to a K*.state or K*.key file. Paired with the DNS timeline above, divergence between the two channels is usually where the interesting DNSSEC bugs live.

State machine timeline

Colour bars show each key's state-machine value over the window. Separate lanes for GoalState, DNSKEYState, KRRSIGState, ZRRSIGState, and DSState. The rndc view is drawn below from rndc dnssec -status; discrepancies between the two are where bugs and BIND quirks usually live.

BIND's view (rndc dnssec -status)

Chronological event log

2026-04-11

Per-key breakdown

For every observed key: the current K*.key timings and K*.state fields captured at report time, plus a calendar and split DNS / File timelines limited to that key's events. KSKs naturally show their DS lifecycle at the parent because DS events are tagged by key tag at emit time.

DNS observations

Samples of what was visible at the zone and at the parent.

Appendix — raw state snapshots

KSK tag=16994

Active: 20250721020444 (Mon Jul 21 02:04:44 2025)
DNSKEYChange: 20250721031944 (Mon Jul 21 03:19:44 2025)
DNSKEYState: omnipresent
DSChange: 20250722030944 (Tue Jul 22 03:09:44 2025)
DSState: rumoured
Generated: 20250721020444 (Mon Jul 21 02:04:44 2025)
GoalState: omnipresent
KRRSIGChange: 20250721031944 (Mon Jul 21 03:19:44 2025)
KRRSIGState: omnipresent
PublishCDS: 20250722030944 (Tue Jul 22 03:09:44 2025)
Published: 20250721020444 (Mon Jul 21 02:04:44 2025)
Removed: 20260722040444 (Wed Jul 22 04:04:44 2026)
Retired: 20260721020444 (Tue Jul 21 02:04:44 2026)

ZSK tag=35423

Active: 20260318020444 (Wed Mar 18 02:04:44 2026)
DNSKEYChange: 20260318020444 (Wed Mar 18 02:04:44 2026)
DNSKEYState: omnipresent
Generated: 20260318004944 (Wed Mar 18 00:49:44 2026)
GoalState: omnipresent
Published: 20260318004944 (Wed Mar 18 00:49:44 2026)
Removed: 20260527030944 (Wed May 27 03:09:44 2026)
Retired: 20260517020444 (Sun May 17 02:04:44 2026)
ZRRSIGChange: 20260328015444 (Sat Mar 28 01:54:44 2026)
ZRRSIGState: omnipresent

ZSK tag=41651

Active: 20260117020444 (Sat Jan 17 02:04:44 2026)
DNSKEYChange: 20260328020944 (Sat Mar 28 02:09:44 2026)
DNSKEYState: hidden
Generated: 20260117004944 (Sat Jan 17 00:49:44 2026)
GoalState: hidden
Published: 20260117004944 (Sat Jan 17 00:49:44 2026)
Removed: 20260328030944 (Sat Mar 28 03:09:44 2026)
Retired: 20260318020444 (Wed Mar 18 02:04:44 2026)
ZRRSIGChange: 20260328030944 (Sat Mar 28 03:09:44 2026)
ZRRSIGState: hidden

ZSK tag=62222

Active: 20251118020444 (Tue Nov 18 02:04:44 2025)
DNSKEYChange: 20260127020944 (Tue Jan 27 02:09:44 2026)
DNSKEYState: hidden
Generated: 20251118004944 (Tue Nov 18 00:49:44 2025)
GoalState: hidden
Published: 20251118004944 (Tue Nov 18 00:49:44 2025)
Removed: 20260127030944 (Tue Jan 27 03:09:44 2026)
Retired: 20260117020444 (Sat Jan 17 02:04:44 2026)
ZRRSIGChange: 20260127030944 (Tue Jan 27 03:09:44 2026)
ZRRSIGState: hidden