follow the root key

[Habbie]

Pretty soon we'll do a Recursor release that is "good enough" in people's minds and then they will stop updating it. That version should ship with more than "here is the root DS as of release date". https://data.iana.org/root-anchors/root-anchors.xml is a good official source of data, which is intended for bootstrapping purposes but would also work in a monthly fetch. Eventually we should do 5011, of course, but this is a big yak.

Useful links:

• http://keyroll.systems/
• https://www.toot-servers.net/
• https://github.com/kirei/dnssec-ta-tools (also see unbound-anchor)

[jpmens]

Simple but effective using a Makefile. :-)

Add something like this after @echo OK:

sed -e "s/^\. IN DS /addDS('.', '/" -e "s/ $/')/" root-anchors.tmp > recursor.conf.lua
rec_control reload-lua-config /etc/powerdns/recursor.conf.lua

[pieterlexis]

I did a quick test with toot-servers.net. Right now, when a new root key is added, the recursor gets the key, but when it rolls, it goes bogus

[Habbie]

This is a distribution/packaging issue, closing.