Re: [ksk-rollover] Revoked KSK-2010 now gone [was: Increased DNSKEY queries to the root servers since the KSK-2010 revocation]

On Mar 22, 2019, at 12:54 PM, Chris Thompson <cet1@cam.ac.uk<mailto:cet1@cam.ac.uk>> wrote: I see the revoked KSK-2010 has gone from the root servers on schedule (as of SOA serial 2019032200<tel:2019032200>). It should be interesting to see whether the DNSKEY query rate to the root servers (1) increases even more (2) falls off now (3) stays much the same. That might give us a whole 1.58 bits of clue as to the cause of the increase in the first place... :-) The root zone without KSK-2010 went out ~1440 UTC. We've already seen a massive drop in DNSKEY queries from everywhere we have data. Note the graph below. Matt [cid:5ECC30BA-3FDF-4B27-B657-714849412377]