Network & Infrastructure / DNS, DNSSEC & Service Discovery
Expired DNSSEC signatures and an unhealthy signing pipeline
A zone fails validation even though no records changed recently. Automated signing can stop refreshing signatures while authoritative servers continue serving an otherwise coherent zone.
Environment and inputs: Authoritative and recursive DNS infrastructure; BIND examples are conceptual and require release-matched configuration. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Record signature inception/expiration times, signing job status, clock health and zone publication serials. Compare the primary signer output with the data actually served by every authoritative endpoint.
Explain the result
Signed data has a validity interval independent of ordinary DNS TTL. A stable zone still needs functioning signature maintenance, and clock error can make signatures appear premature or expired.
Plan the fix
Repair the signing and publication pipeline using its documented procedures. Add expiry monitoring early enough to cover operational response and parent dependencies where relevant.
Check the result and rollback
Validate the refreshed zone and confirm every server publishes current signatures. Revert publication if the new output has inconsistent keys or unexpectedly removes records during signing recovery.