In theory a variety of key rollover mechanisms are possible and are described in detail in: http://tools.ietf.org/html/draft-morris-dnsop-dnssec-key-timing-02
Also see: http://tools.ietf.org/html/draft-mekking-dnsop-dnssec-key-timing-bis-02
A summary is given below:
| ZSK Method | KSK Method | Description |
|---|---|---|
| Pre-Publication | N/A | Publish DNSKEY before the RRSIG |
| Double-Signature | Double-signature | Publish DNSKEY and RRSIG at the same time. For a KSK, this happens before the DS is published |
| Double RR-sig | N/A | Publish RRSIG before the DNSKEY |
| N/A | Double-DS | Publish DS before DNSKEY |
| N/A | Double-RRset | Publish DNSKEY and DS in parallel. |
OpenDNSSEC currently supports the following mechanisms:
Future versions of OpenDNSSEC will support additional mechanisms.
