Every observed key on a time axis, grouped by
(role, algorithm), with phase-coloured bars
(pre-publication / published / active / retired / removed). A
thin DS overlay stripe above each KSK row shows when the
parent-side chain of trust was actually complete, which is
often when the interesting DNSSEC stories happen. If two
algorithms are simultaneously active, the overlap region is
highlighted behind their bars.
Calendar view
Monthly calendars covering the reported window. Each day is
shaded by the number of events observed and carries a coloured
dot for every event source that fired that day. Hover any day
for the count and a sample of the events (live UI only).
Events observed via live DNS queries and reported by
rndc dnssec -status. Dots are coloured by
source, stacked to avoid overlap, and the significant
transitions are labelled inline.
File event timeline
Changes observed directly on disk — every modification to a
K*.state or K*.key file. Paired with
the DNS timeline above, divergence between the two channels is
usually where the interesting DNSSEC bugs live.
State machine timeline
Colour bars show each key's state-machine value over the window.
Separate lanes for GoalState, DNSKEYState,
KRRSIGState, ZRRSIGState, and
DSState. The rndc view is drawn below from
rndc dnssec -status; discrepancies between the two
are where bugs and BIND quirks usually live.
BIND's view (rndc dnssec -status)
Chronological event log
2026-04-11
Time
Source
Key
Type
Summary
11:03:18Z
key
ZSK 22826
key_file_observed
new K*.key for iodyn-dns.org ZSK tag=22826
11:03:18Z
key
ZSK 60228
key_file_observed
new K*.key for iodyn-dns.org ZSK tag=60228
11:03:18Z
key
KSK 53123
key_file_observed
new K*.key for iodyn-dns.org KSK tag=53123
11:03:19Z
dns
60228
dns_dnskey_appeared_at_zone
DNSKEY (key tag 60228) appeared at zone for iodyn-dns.org
11:03:19Z
dns
22826
dns_dnskey_appeared_at_zone
DNSKEY (key tag 22826) appeared at zone for iodyn-dns.org
11:03:19Z
dns
53123
dns_dnskey_appeared_at_zone
DNSKEY (key tag 53123) appeared at zone for iodyn-dns.org
11:03:19Z
dns
dns_soa_appeared_at_zone
SOA observed at zone for iodyn-dns.org (serial 75)
11:03:19Z
dns
53123
dns_ds_appeared_at_parent
DS (key tag 53123) appeared at parent for iodyn-dns.org
11:03:19Z
rndc
rndc_first_observation
iodyn-dns.org: observed 0 key(s) via rndc
13:03:18Z
dns
53123
dns_rrsig_appeared_at_zone
RRSIG over DNSKEY (key tag 53123) appeared at zone for iodyn-dns.org
13:03:18Z
dns
60228
dns_rrsig_appeared_at_zone
RRSIG over SOA (key tag 60228) appeared at zone for iodyn-dns.org
19:06:31Z
dns
60228
dns_rrsig_appeared_at_zone
RRSIG over SOA (key tag 60228) appeared at zone for iodyn-dns.org
19:06:31Z
dns
60228
dns_rrsig_disappeared_at_zone
RRSIG over SOA (key tag 60228) disappeared at zone for iodyn-dns.org
20:26:16Z
dns
60228
dns_rrsig_appeared_at_zone
RRSIG over SOA (key tag 60228) appeared at zone for iodyn-dns.org
20:26:16Z
dns
60228
dns_rrsig_disappeared_at_zone
RRSIG over SOA (key tag 60228) disappeared at zone for iodyn-dns.org
Per-key breakdown
For every observed key: the current K*.key timings
and K*.state fields captured at report time, plus a
calendar and split DNS / File timelines limited to that key's
events. KSKs naturally show their DS lifecycle at the parent
because DS events are tagged by key tag at emit time.
KSK · tag 53123
Algorithm: 13 ·
Key id: Kiodyn-dns.org.+013+53123 ·
First seen: 2026-04-11T11:03:18Z