Re: [dns-wg] Bad secure delegation of ris.ripe.net

[Sjoerd Oostdijck sjoerdoo@localhost]

Alexander Gall wrote:
> Hello DISI
> 
> The zone ris.ripe.net is bogus.  It appears that the DS RR doesn't
> match the KSK DNSKEY RR.  ripe.net is fine (with the newest trust
> anchors).  According to drill:
> 
> 
Dear mr Gall and mailing list,

Due to human error on our side the DS records were not updated when
we introduced new keys 3 months ago. When we removed the old keys
yesterday the DS records stopped working. I fixed the DS records
this morning around 10:40 CET so things should be back up and working
as soon as the zone is reloaded on your nameserver or the TTL expires.

Kind regards,

-- 
Sjoerd Oostdijck -- DNS Services group
Ripe NCC         -- Singel 258 Amsterdam NL