Subject: [DNSOP] Question about the time of regular DS rollover by ICANN

From: "Zheng Wang" <[email-masked]>
Date: Mon, 10 Jan 2011 08:40:33 +0800

I have a question on the ICANN's processing time of the regular DS RR rollover
request from TLD operators. 

I find in ICANN's document saying that "the emergency change process will be
completed and reflected in the root zone within 48 hours from the reception of a
valid emergency removal request", but this is only for an emergency change, as the
regular change is more frequently requested by the TLD operators, what about the
time taken by the scheduled key rollovers?

---

From: Doug Barton <[email-masked]>
Date: Sun, 09 Jan 2011 22:50:02 -0800

> time taken by the scheduled key rollovers?

I'm confused, why are you asking here rather than asking ICANN?

Doug

-- 

	Nothin' ever doesn't change, but nothin' changes much.
			-- OK Go

	Breadth of IT experience, and depth of knowledge in the DNS.
	Yours for the right price.  :)  http://SupersetSolutions.com/

---

From: Joe Abley <[email-masked]>
Date: Mon, 10 Jan 2011 07:51:27 -0800

> time taken by the scheduled key rollovers? 

Root zone changes (with no associated change of organisation, i.e. simple, technical changes with no layer-9 complications) tend to take the same amount of time to process regardless of whether they involve NS, A or DS RRSet changes. Since I don't work in that area I don't have any good statistics to give you, but [email-masked] might be able to help if you need more.

Anecdotally, I've submitted DS record changes for various TLDs over the past few months (e.g. the test IDN TLDs, for which we rolled the KSK a while ago) and they were all processed in a few working days.

For a scheduled change, precise timing for the workflow seems less important than for emergency changes, since the TLD manager has the opportunity to generate the incoming keys in advance and submit the root zone change request before the replacement KSK is published. The final transition can then be managed by changes to the TLD zone, which is all in the TLD manager's control; the old DS records can be removed from the root zone later as a separate request.

Emergency changes are a different matter (since it's difficult to plan ahead of an unplanned emergency), which is why the 48-hour processing time was specified.

Joe