On Wed, 25 Mar 2020, ya...@sdf.org wrote: > Another user on the ISC list suggested setting > dnssec-lookaside no; > Which also feels risky.
Comment out or remove the NetBSD provided configuration for that in named.conf. > And generically ISC suggested all users remove the dlv.isc.org zone from > their configuration...because the zone is empty and if removed would not > cause > the expired key to fail dns... > > My only problem is I do not know how to remove as I cannot find this zone in > my configuration. Not a zone but a managed keys (or trusted keys) configuration. Remove the reference to it (a few lines) from your bind keys file, probably at /etc/namedb/bind.keys If you have managed-keys or trusted-keys with it elsewhere remove those lines there too. But be sure to keep the DNS root zone's keys. (Looking at my old sent-mail, I tested and reported about this scenario in May 2014.)