[v9_10] document default DNSKEY TTL

- see RT #38268

diff --git a/bin/dnssec/dnssec-keygen.docbook b/bin/dnssec/dnssec-keygen.docbook
index cab897487415256e4a7aff9b6146f09c35cb7713..1df4907a7a190f886fd055fc441509e1a2f6ceb5 100644 (file)
--- a/bin/dnssec/dnssec-keygen.docbook
+++ b/bin/dnssec/dnssec-keygen.docbook
@@ -306,8 +306,10 @@
             into a DNSKEY RR.  If the key is imported into a zone,
             this is the TTL that will be used for it, unless there was
             already a DNSKEY RRset in place, in which case the existing TTL
-            would take precedence.  Setting the default TTL to
-            <literal>0</literal> or <literal>none</literal> removes it.
+            would take precedence.  If this value is not set and there
+            is no existing DNSKEY RRset, the TTL will default to the
+            SOA TTL. Setting the default TTL to <literal>0</literal>
+            or <literal>none</literal> is the same as leaving it unset.
           </para>
         </listitem>
       </varlistentry>

diff --git a/bin/dnssec/dnssec-settime.docbook b/bin/dnssec/dnssec-settime.docbook
index 33a9fd5bd332c658a283934e42dff321927440ca..79a4756b99bbce99c5670ee371a4bf0d7cde3c86 100644 (file)
--- a/bin/dnssec/dnssec-settime.docbook
+++ b/bin/dnssec/dnssec-settime.docbook
@@ -126,8 +126,10 @@
             into a DNSKEY RR.  If the key is imported into a zone,
             this is the TTL that will be used for it, unless there was
             already a DNSKEY RRset in place, in which case the existing TTL
-            would take precedence.  Setting the default TTL to
-            <literal>0</literal> or <literal>none</literal> removes it.
+            would take precedence.  If this value is not set and there
+            is no existing DNSKEY RRset, the TTL will default to the
+            SOA TTL. Setting the default TTL to <literal>0</literal>
+            or <literal>none</literal> removes it from the key.
           </para>
         </listitem>
       </varlistentry>

diff --git a/doc/arm/dnssec.xml b/doc/arm/dnssec.xml
index 7fa9aa75b33221f499c288bf981378fff49a20ad..2dc1932dc71065557c5429010a0623fe005896b6 100644 (file)
--- a/doc/arm/dnssec.xml
+++ b/doc/arm/dnssec.xml
@@ -15,8 +15,6 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: dnssec.xml,v 1.7 2011/10/13 23:47:10 tbox Exp $ -->
-
 <sect1 id="dnssec.dynamic.zones">
   <title>DNSSEC, Dynamic Zones, and Automatic Signing</title>
   <para>As of BIND 9.7.0 it is possible to change a dynamic zone
@@ -127,6 +125,13 @@
   key changes, however.)
   </para>
   <para>
+  When new keys are added to a zone, the TTL is set to match that
+  of any existing DNSKEY RRset. If there is no existing DNSKEY RRset,
+  then the TTL will be set to the TTL specified when the key was
+  created (using the <command>dnssec-keygen -L</command> option), if
+  any, or to the SOA TTL.
+  </para>
+  <para>
   If you wish the zone to be signed using NSEC3 instead of NSEC,
   submit an NSEC3PARAM record via dynamic update prior to the
   scheduled publication and activation of the keys.  If you wish the