Hi T.Suzuki, Do you have prefetch-key enabled still? It causes the DNSKEY to be prefetched. If so, that would just be extra data in the cache, and not hamper KSK rollovers.
Otherwise, unbound shouldn't be fetching the DNSKEY itself then, but downstream clients could still be asking for it. Best regards, Wouter On 03/08/17 02:05, T.Suzuki via Unbound-users wrote: > I found a packet requesting dnskey record at priming,in spite of removing > "validator" from my config. > What is the purpose of this function? > I think this function may cause trouble with KSK rollover. >
signature.asc
Description: OpenPGP digital signature
