#+TITLE: DNSSEC algorithm roll-over
#+DATE: 2020-06-08

* Intro
tlakh.xyz uses [[https://powerdns.com/][PowerDNS]] running on OpenBSD as a hidden signer. Zones
are transferred via AXFR to authoritative nameservers running [[https://www.nlnetlabs.nl/projects/nsd/about/][NSD]] on
OpenBSD. Version 4.3 of PowerDNS introduced support for [[https://doc.powerdns.com/authoritative/changelog/4.3.html#change-8b0ef5df0dad7b9d5c3c8957a3022cec][algorithm
roll-overs]]. We wanted to change the signing algorithm from =RSASHA512=
(Algorithm 10) to =ECDSAP256SHA256= (Algorithm 13) as recommended by
[[https://tools.ietf.org/html/rfc8624#section-3.2][RFC 8624]]. We followed [[https://tools.ietf.org/html/rfc6781.html#section-4.1.4][RFC 6781]] for the rollover steps.
* Roll-over
The following subsections will use the state names from  [[https://tools.ietf.org/html/rfc6781.html#section-4.1.4][RFC 6781]].
** initial
On June 8th 2020 tlakh.xyz was signed with RSASHA512 (Algorithm
10). We wanted to change the algorithm to ECDSAP256SHA256 (Algorithm
13).
#+begin_example
$ pdnsutil list-keys tlakh.xyz
Zone                          Type    Size    Algorithm    ID   Location    Keytag
----------------------------------------------------------------------------------
tlakh.xyz                     ZSK     2048    RSASHA512    6    cryptokeys  65156
tlakh.xyz                     KSK     4096    RSASHA512    5    cryptokeys  15216
#+end_example
** new RRSIGs
DNSKEYs and RRSIGs in the tlakh.xyz zone have a TTL of 86000 seconds
(1 day):
#+begin_example
$ dig @a.ns.sha256.net. +dnssec +norec +noall +answer tlakh.xyz DNSKEY
tlakh.xyz.		86400	IN	DNSKEY	256 3 10 AwEAAaqRIYWrsASI40dwuwfbo04WT0SAKOi3espbBQuRIRS0t74isCgN H7lCzOf5AW50fwSWpceiY5CB7gddvKCJIJyBrRLkaFdT5cPGDfklNcYY Cp+pv8u1umzoiDtpoDZcnqtO7+0TuGZVweMLrVajrapZkeSp3h4I1kDw PQhcpcJnuYeN/nMtLggfX19X/sXPKo6Gm23n3gTXp8EZu9dGy5KcQYdx ilQCUL2RVJqoYBDOoLtF3spthEXbsxDobCPz2zbzENvNWLtV7aZSiefu SoBfZlGxC9eWypo5LtCaJlfQiUktFrB0BqrmIWqHxuAa2c1+bZuhdlEq 4Oa+UGd4N9M=
tlakh.xyz.		86400	IN	DNSKEY	257 3 10 AwEAAeoCANNycAHU3FtrctGycQ1/I5pN8iWNSZVhruxJsyiD75H7Mzet /gWRLiNmJ6e/aFPYuvWtdOjFyfOec5gIlI9J9cxY4L3KRSkeB/wjPkxf 9GXvqxcDLg3P1eaC63/rPdhjfgq3nE3Bw3NXlTuD6SWB6YdfioiyVo+e JThrYhaFqKzPqZbGn3fEGuOp39zJ+Qunq98Vg7oTh0ch3k2H9XhRP3W+ zEPnvmPKLo9+k92xvfZasgCay8vjaNRQubn9nNtNwUPKJSCIXKvmrykB PLAXBcjHlFSc6D7g4jVwzWrYtEeAA+fxqA/UBXGFrJWC3ZdD/mtDkT+v JKAL4HqCojFrRKgWq//QenhjZeZ0Efq767ZvZvqoyNweTcwGdXYteRCB R0qV4TLjD8vMczMfFboZkEJo4Xj8xDDmoslErlMGsC8TJ0uQeKB6YqKI dRJqQwtrFHx+rxFvA3+SAcKlccjZo2024f2Rq0lUSb838j1z1xY9ACh/ ht0ixk0bArQ/TdqNC6SwTniiQaJfmIik64gCZE7sxMJmryxkEjtHiLie Czls4RUMpuIc3F6d/3Gq75sgt129bYWWzNIsGaqZKL97Zl4qVpOsK3I7 yX7gNR7ogp7d/bGj11BUOU3ZsmJ30tvcD8CdNhokXFTyx8Z4QvNuUJKt TalgU/yRpCwTclRB
tlakh.xyz.		86400	IN	RRSIG	DNSKEY 10 2 86400 20200618000000 20200528000000 15216 tlakh.xyz. gE3lNMY/Ted8nvgXH+rBm+uuKMUly5fp061Hd9kePhZSvZWzH2gaaTaJ s0kXUNBYsuUX1BeThZWPLqJDEKk9hkiffT8Mt7dBVsP9cS7rj8sM10st UWN7vrxpY4dcToknuyRaIiHU7K0/0pGWcgUcTJnwfuJfmDYexNZUf4mW kG5Ro89sSLZR3c9peKvXUig7f61e3QbS1m0h1ZsEf/hQuozb354z+x2I 0zv1LqFZt8IOTF5AD5RcZe1OatJlF02Z5Yzkj75uwa5MTD8Gfwu1vmTL 9gOieVu+10PJub7y62kcr5ZMmkUXeTHcMG+Oy6Y9IOMBMF2btNmCDY2P rGNReiRDSnQEU9726KeVGtlhyAjqDwCFuFWYug3cCJZ98aQrOXSjWXTG XyOyO+fxT2BfzUbq4L35xv34f83g5ulZvFO/oUXz1Rulhut3UUSGyev3 jqzQ4VIcYwsXRRWrlG+fZUhYtDjXCcqAtZyHtOY2oU5CNKuYDvyZMdAQ voecdB0VzzX3TXBV+ykpPeLp/qOKhxRYZao4p7ZkXqHAxSXjrV3ws2// CQhD43ex+qleMGPrlQkHa5sjwGhgvfEyqV2YKOcq41I/j8nltHoZy2sR 6NlFv1TAWlNgK4bHGQmQHTnC95URgSzFuemy4d6JDo/htFLfTIMRjWbj 9OqBoT/8xgw=
#+end_example

After introducing RRSIGs made with the new key we had to wait at least
1 day for the new RRset to propagate to caches. At about 16:45 UTC on
June 8th 2020 we introduced new ZSK and KSK keys with algorithm 13 but
set the key to unpublished:
#+begin_example
$ pdnsutil add-zone-key tlakh.xyz zsk active unpublished ecdsa256
Added a ZSK with algorithm = 13, active=1
$ pdnsutil add-zone-key tlakh.xyz ksk  active unpublished ecdsa256
Added a KSK with algorithm = 13, active=1
$ pdnsutil list-keys tlakh.xyz
Zone                          Type    Size    Algorithm    ID   Location    Keytag
----------------------------------------------------------------------------------
tlakh.xyz                     ZSK     2048    RSASHA512    6    cryptokeys  65156
tlakh.xyz                     ZSK     256     ECDSAP256SHA256 13   cryptokeys  60132
tlakh.xyz                     KSK     4096    RSASHA512    5    cryptokeys  15216
tlakh.xyz                     KSK     256     ECDSAP256SHA256 14   cryptokeys  22433
#+end_example

The newly signed zone had now double signatures:
#+begin_example
$ dig @a.ns.sha256.net. +dnssec +norec +noall +answer tlakh.xyz A
tlakh.xyz.		86400	IN	A	45.32.179.105
tlakh.xyz.		86400	IN	RRSIG	A 10 2 86400 20200618000000 20200528000000 65156 tlakh.xyz. ocpnfmI2U0l24+PGUhiJwYaezqpFnpTgTphW6zfuc8uIqYrc94xcGx9o 9Bt6RoSWd1X0DG2BKWZKHI+5NEFZ1YQvTP3n5MzPNP8f9KCUkriY0Y6z RwxZJK9x/m5HuB9Nd1+sASFzc4rZme/EKGFvbGooAznFe2WAxblNLxA/ yrXHwuP5tBh4SYrgayQCFWHgrbtJfS57d/s/KorwhwQIAsiqLg68rFV3 IPjaKjWWgQfEsiAq0fuEULuRTZffqdMrLtzj9LHo2h3n9jKwHZ/B/8Cs gi3/Cu62PlBOtSRBi107jyC6TXmTzyK6YdhjJ0heam3eFXo7vSAmmTj8 UagaIQ==
tlakh.xyz.		86400	IN	RRSIG	A 13 2 86400 20200618000000 20200528000000 60132 tlakh.xyz. Gqg0ML2H/O3EFSH1IolyrwGmbt/U6RkMxHnz7w1OGzmP+d4c7hyFuNdb 2zZXlTVYws0RnExAoY/3rOF7dTa3IA==
#+end_example

[[https://dnsviz.net/d/tlakh.xyz/Xt5ssA/dnssec/][dnsviz]] ([[file:algorithm-roll/tlakh.xyz-2020-06-08-16_52_00-UTC.png][local copy]]) also saw RRsets from the new keys but not the keys
themselves.

** new DNSKEY
At about 16:55 UTC on June 9th 2020 we published the new DNSKEYs:
#+begin_example
$ pdnsutil publish-zone-key tlakh.xyz 13
$ pdnsutil publish-zone-key tlakh.xyz 14
#+end_example

The newly signed zone now had 4 DNSKEYs:
#+begin_example
$ dig @a.ns.sha256.net. +dnssec +norec +noall +answer tlakh.xyz DNSKEY
tlakh.xyz.		86400	IN	DNSKEY	256 3 10 AwEAAaqRIYWrsASI40dwuwfbo04WT0SAKOi3espbBQuRIRS0t74isCgN H7lCzOf5AW50fwSWpceiY5CB7gddvKCJIJyBrRLkaFdT5cPGDfklNcYY Cp+pv8u1umzoiDtpoDZcnqtO7+0TuGZVweMLrVajrapZkeSp3h4I1kDw PQhcpcJnuYeN/nMtLggfX19X/sXPKo6Gm23n3gTXp8EZu9dGy5KcQYdx ilQCUL2RVJqoYBDOoLtF3spthEXbsxDobCPz2zbzENvNWLtV7aZSiefu SoBfZlGxC9eWypo5LtCaJlfQiUktFrB0BqrmIWqHxuAa2c1+bZuhdlEq 4Oa+UGd4N9M=
tlakh.xyz.		86400	IN	DNSKEY	256 3 13 9Du0N8A9jI+w3gbBcuyaaL9YMM/ooAJvvpewmooIfWajgFPyLvGhr0zR ylhMCoVtbl4XSMD+di1LMiAIhPN9Eg==
tlakh.xyz.		86400	IN	DNSKEY	257 3 10 AwEAAeoCANNycAHU3FtrctGycQ1/I5pN8iWNSZVhruxJsyiD75H7Mzet /gWRLiNmJ6e/aFPYuvWtdOjFyfOec5gIlI9J9cxY4L3KRSkeB/wjPkxf 9GXvqxcDLg3P1eaC63/rPdhjfgq3nE3Bw3NXlTuD6SWB6YdfioiyVo+e JThrYhaFqKzPqZbGn3fEGuOp39zJ+Qunq98Vg7oTh0ch3k2H9XhRP3W+ zEPnvmPKLo9+k92xvfZasgCay8vjaNRQubn9nNtNwUPKJSCIXKvmrykB PLAXBcjHlFSc6D7g4jVwzWrYtEeAA+fxqA/UBXGFrJWC3ZdD/mtDkT+v JKAL4HqCojFrRKgWq//QenhjZeZ0Efq767ZvZvqoyNweTcwGdXYteRCB R0qV4TLjD8vMczMfFboZkEJo4Xj8xDDmoslErlMGsC8TJ0uQeKB6YqKI dRJqQwtrFHx+rxFvA3+SAcKlccjZo2024f2Rq0lUSb838j1z1xY9ACh/ ht0ixk0bArQ/TdqNC6SwTniiQaJfmIik64gCZE7sxMJmryxkEjtHiLie Czls4RUMpuIc3F6d/3Gq75sgt129bYWWzNIsGaqZKL97Zl4qVpOsK3I7 yX7gNR7ogp7d/bGj11BUOU3ZsmJ30tvcD8CdNhokXFTyx8Z4QvNuUJKt TalgU/yRpCwTclRB
tlakh.xyz.		86400	IN	DNSKEY	257 3 13 p3cC5drs8jRsY7um9Bb4QyEfecpyY5oXh45X4FskftvDAda46SVT9WVe uqIgofK/XfEW15ugLkWjF5uHCKPWsw==
tlakh.xyz.		86400	IN	RRSIG	DNSKEY 10 2 86400 20200618000000 20200528000000 15216 tlakh.xyz. H5ZuAY1cMy3IPQiRahFzO4XeFpkFD1IRNSxffBL/JrfAsg3WuKEHBjhN NefYeMccydd/TB4A+D01xUKHqTEg6HhEbeCdzbihEmgHZeMXIt6G/OVA jWqEyspahK5AbDyIAWoKInaDC9NfHA8uxqFmnU7dpVg26hhuAaiQJE7j RxyoKXZY857jzEZf6E62QHw/7l9z/e5R94R/Nfc73Ch57MyWsH7pY+CS KXI6KhrfK5wY/paDPLzWP48KZ5VoP+laPFSV1qFYFa40hk/Z0wbZGQSm iKrk3Dfu6lagEeYfXDaCzISauwCYbxTw4l8adXbbBypAtdrFqcUaaCZG 5KjOFcYrUtymaucShbwjfcWrZdJTd4D32tNrWhv17QQCM1k3M7uO8FdG jyPPfoChRSh3Hd5h4v8z2bkjIrMd4Z54xeaxoL49+2R0L0ei6L/4pxap 7SVVOkqICTlT4nMI2XihTEmmqFeOQNoKdgYb/VHZqWP9n8jqlXf5emr6 UQS8bSH1pjigslY7ug8bW/tvfcPX2AtAXW2M0HmxgOlbxFC8AqYJom5l dqpPbTeyyXawE/TBf/naAvkXpzyYoIU1N5oI4ckRyEaJEO2rjgmtn4fA JDo2HjMmssFyiH/pGSSiV/ZbOqri6XecsKOIgr5LvzMeAHRkw9od2Kmg Y9NUjUfPMVk=
tlakh.xyz.		86400	IN	RRSIG	DNSKEY 13 2 86400 20200618000000 20200528000000 22433 tlakh.xyz. rtFezrjl4R0A8SvyYCDg5M1SNASINPcLqNdYzveKqq80sVqKwmvr+o9l IQMFPE5PMIFYC7SS5utV8I5RqNV/7Q==
#+end_example

[[https://dnsviz.net/d/tlakh.xyz/Xt-_BQ/dnssec/][dnsviz]] ([[file:algorithm-roll/tlakh.xyz-2020-06-09-16_55_33-UTC.png][local copy]]) also saw all DNSKEYs. There seemed to be arrows
missing from the DNSKEY with id 22433 to all other DNSKEYs on the
dnsviz visualisation but the [[https://dnsviz.net/d/tlakh.xyz/Xt-_BQ/responses/][responses]] showed the RRSIG from the new
DNSKEY.

** new DS
The old DNSKYE RRset containing only two keys expired around 17:00 UTC
on June 10th 2020. At this point the old DS record could have been
replaced with a new DS record but we didn't get around to it.

We continued on the morning of the 11th, first we fetched the NS set
for xyz:
#+begin_example
$ dig +noall +answer xyz NS
xyz.			37933	IN	NS	x.nic.xyz.
xyz.			37933	IN	NS	y.nic.xyz.
xyz.			37933	IN	NS	z.nic.xyz.
xyz.			37933	IN	NS	generationxyz.nic.xyz.
#+end_example

and checked all of them for the DS record for tlakh.xyz:
#+begin_example
$ for i in x y z generationxyz; do dig @$i.nic.xyz +noall +answer tlakh.xyz DS; done
tlakh.xyz.		3600	IN	DS	15216 10 2 38C610B933677FC6BB5E39E3649646691AABDD5100D0BF6362E5A095 4477CC8A
tlakh.xyz.		3600	IN	DS	15216 10 2 38C610B933677FC6BB5E39E3649646691AABDD5100D0BF6362E5A095 4477CC8A
tlakh.xyz.		3600	IN	DS	15216 10 2 38C610B933677FC6BB5E39E3649646691AABDD5100D0BF6362E5A095 4477CC8A
tlakh.xyz.		3600	IN	DS	15216 10 2 38C610B933677FC6BB5E39E3649646691AABDD5100D0BF6362E5A095 4477CC8A
#+end_example

The TTL was 3600 seconds or one hour. After introducing the new DS
record we had to wait at least this long. This is complicated by the
fact that we did not now how long it would take for the DS record to
show up in the xyz zone and how long it would take for the xyz zone to
propagate to all authoritative nameservers. xyz probably employed
anycast as well so it would be very difficult for us to observe all
nameservers. The registrar for tlakh.xyz wants the DNSKEY to submit
the DS record to the registry:
#+begin_example
$ pdnsutil export-zone-dnskey tlakh.xyz 14
tlakh.xyz IN DNSKEY 257 3 13 p3cC5drs8jRsY7um9Bb4QyEfecpyY5oXh45X4FskftvDAda46SVT9WVeuqIgofK/XfEW15ugLkWjF5uHCKPWsw==
#+end_example

We entered the DNSKEY in the registrar webinterface at about 05:45 UTC
on June 11th 2020. At 05:52 we started to see the new DS record on
some authoritative nameservers:
#+begin_example
$ for i in x y z generationxyz; do dig @$i.nic.xyz +noall +answer tlakh.xyz DS; done
tlakh.xyz.		3600	IN	DS	15216 10 2 38C610B933677FC6BB5E39E3649646691AABDD5100D0BF6362E5A095 4477CC8A
tlakh.xyz.		3600	IN	DS	22433 13 2 692C34230671F2CD2A2D7DC7432B373B556D357787883DE754660A69 E4F6D05F
tlakh.xyz.		3600	IN	DS	22433 13 2 692C34230671F2CD2A2D7DC7432B373B556D357787883DE754660A69 E4F6D05F
tlakh.xyz.		3600	IN	DS	15216 10 2 38C610B933677FC6BB5E39E3649646691AABDD5100D0BF6362E5A095 4477CC8A
#+end_example

And at 05:53 it was visible on all nameservers, at least from this
vantage point:
#+begin_example
$ for i in x y z generationxyz; do dig @$i.nic.xyz +noall +answer +norec tlakh.xyz DS; done
tlakh.xyz.		3600	IN	DS	22433 13 2 692C34230671F2CD2A2D7DC7432B373B556D357787883DE754660A69 E4F6D05F
tlakh.xyz.		3600	IN	DS	22433 13 2 692C34230671F2CD2A2D7DC7432B373B556D357787883DE754660A69 E4F6D05F
tlakh.xyz.		3600	IN	DS	22433 13 2 692C34230671F2CD2A2D7DC7432B373B556D357787883DE754660A69 E4F6D05F
tlakh.xyz.		3600	IN	DS	22433 13 2 692C34230671F2CD2A2D7DC7432B373B556D357787883DE754660A69 E4F6D05F
#+end_example

We then setup 4 RIPE Atlas measurements to query [[https://atlas.ripe.net/measurements/25704650/][x.nic.xyz]], [[https://atlas.ripe.net/measurements/25704651/][y.nic.xyz]],
[[https://atlas.ripe.net/measurements/25704652/][z.nic.xyz]], and [[https://atlas.ripe.net/measurements/25704654/][generationxyz.nic.xyz]] for the DS record of tlakh.xyz
from 500 probes world wide. We used the RIPE Atlas cli tool to analyse
the results, for example for x.nic.xyz:
#+begin_example
$ ripe-atlas report 25704650 | fgrep DS | sort | uniq -c
 468   ;tlakh.xyz.                      IN     DS
   1   tlakh.xyz.              3577     IN     DS     22433 13 2 692c34230671f2cd2a2d7dc7432b373b556d357787883de754660a69e4f6d05f
 457   tlakh.xyz.              3600     IN     DS     22433 13 2 692c34230671f2cd2a2d7dc7432b373b556d357787883de754660a69e4f6d05f
#+end_example

At about 06:00 UTC we were confident that the new DS record had
propagated world wide. [[https://dnsviz.net/d/tlakh.xyz/XuHKww/dnssec/][dnsviz]] ([[file:algorithm-roll/tlakh.xyz-2020-06-11-06_10_11-UTC.png][local copy]]) saw the new DS record
pointing to the new DNSKEY.
** DNSKEY removal
With a TTL of one hour for the DS record in the xyz zone the old
DNSKEYs could have been removed at 07:00 UTC on June 11th 2020. We
removed them one hour later, at around 08:00 UTC:
#+begin_example
$ pdnsutil  unpublish-zone-key tlakh.xyz 6
$ pdnsutil  unpublish-zone-key tlakh.xyz 5
#+end_example

We saw two DNSKEYs instead of four, one ZSK and one KSK. There are
still two RRSIGs, one with algorithm 10, the old one and one with
algorithm 13 since we only unpublished the old keys but they are still
used for signing.
#+begin_example
$ dig @a.ns.sha256.net. +dnssec +norec +noall +answer tlakh.xyz DNSKEY
tlakh.xyz.		86400	IN	DNSKEY	256 3 13 9Du0N8A9jI+w3gbBcuyaaL9YMM/ooAJvvpewmooIfWajgFPyLvGhr0zR ylhMCoVtbl4XSMD+di1LMiAIhPN9Eg==
tlakh.xyz.		86400	IN	DNSKEY	257 3 13 p3cC5drs8jRsY7um9Bb4QyEfecpyY5oXh45X4FskftvDAda46SVT9WVe uqIgofK/XfEW15ugLkWjF5uHCKPWsw==
tlakh.xyz.		86400	IN	RRSIG	DNSKEY 10 2 86400 20200625000000 20200604000000 15216 tlakh.xyz. dGiAsG2KyIgivCEsEwXpCUg8vHspOJcDavDWF4ob5D4AaGxOg2rsUDeu AhbNRfKjWVwNOYNf4zxyqqDNAQeyU00ZsrBDhWkz4gGH8MHddB8quLzX vQDjhv4gHepidFOy1QIyKGsgvwPoxSDf5VpHYJxUiZKSq1AERT/IeR0Q DOqQcJ/UAjRLdXDox3JqFnwmvXoyY5SDjxIoHiRU5gnmEmDpFyvrLMUY SfQ8LvU4KV0UFIPWHjyApgysk2YFJfLWFiKrBZMAaD/aD6rTuvPIdPq7 AYGC5YpsR3+6m6S1uKKfeC2ZdnacKdVgVWcIuL3KrnHflpSGtEcL7Y2V gBYY96eEWKSQ8IlOp5fpIQbQcw31R3dQeQWuac8U3NmH+X2UNzZtozLI 5d5U8ZqYZKkoVh6K4cCxZjkx6UnFeSL4FAHxFc05/1sixED8ueFhCa15 NdKaRpPJXjTAqN5Ans8Z/jJ+aosg7Cnn7BrQTg0/qhU9TYY7U8PdaBaP cCwrkENdA1LvitXa/kI9G2r9c0WMkUh5zOcVxytmYot5zVzjXoB7lD2q OE0efBCKEfwI93aOD3CdS/9aE6eB7A0TAhI/MejCho3dNFM48TF57EHc 1WOVxFVdAYyw8bcKTFV5sQOzt5YN3iU4TD4Y3ZnJ0w3/LhD24ngm/A3p zNmtB2mqwhI=
tlakh.xyz.		86400	IN	RRSIG	DNSKEY 13 2 86400 20200625000000 20200604000000 22433 tlakh.xyz. CbBp81aMiMLXoAbJuPA0XymHiYJGyWiIKXxAQpoTWGN7sc2P/mF/Ea9V Rg1tYw392vEhM/bi9GjHHnzNQR6+1g==
#+end_example

[[https://dnsviz.net/d/tlakh.xyz/XuHlmg/dnssec/][dnsviz]] ([[file:algorithm-roll/tlakh.xyz-2020-06-11-08_04_42-UTC.png][local copy]]) saw RRSIGs from the old key but no longer the key.

** RRSIGs removal
One day later, at about 08:15 on June 12th 2020 it was time to
completely remove the old keys:
#+begin_example
$ pdnsutil remove-zone-key tlakh.xyz 5
$ pdnsutil remove-zone-key tlakh.xyz 6
#+end_example

The DNSKYEY RRset was only signed by the new and now only KSK key:
#+begin_example
$ dig @a.ns.sha256.net. +dnssec +norec +noall +answer tlakh.xyz DNSKEY
tlakh.xyz.		86400	IN	DNSKEY	256 3 13 9Du0N8A9jI+w3gbBcuyaaL9YMM/ooAJvvpewmooIfWajgFPyLvGhr0zR ylhMCoVtbl4XSMD+di1LMiAIhPN9Eg==
tlakh.xyz.		86400	IN	DNSKEY	257 3 13 p3cC5drs8jRsY7um9Bb4QyEfecpyY5oXh45X4FskftvDAda46SVT9WVe uqIgofK/XfEW15ugLkWjF5uHCKPWsw==
tlakh.xyz.		86400	IN	RRSIG	DNSKEY 13 2 86400 20200625000000 20200604000000 22433 tlakh.xyz. CbBp81aMiMLXoAbJuPA0XymHiYJGyWiIKXxAQpoTWGN7sc2P/mF/Ea9V Rg1tYw392vEhM/bi9GjHHnzNQR6+1g==
#+end_example

[[https://dnsviz.net/d/tlakh.xyz/XuM6QA/dnssec/][dnsviz]] ([[file:algorithm-roll/tlakh.xyz-2020-06-12-08_18_08-UTC.png][local copy]]) confirmed this. With this the algorithm roll-over
was done.
