[nsd-users] zones with TLSA records fail to transfer to opendnssec

[Michael Grimm]

Hi —

I am unsure whether that is an issue with nsd or openndssec, thus I will copy my mail to the opendnssec mailing list:

	This is with opendnssec 1.4.7 and nsd 4.1.2 in a FBSD10-STABLE jail.

	I recently noticed, after trying to modify one of my zones, that some of my zones fail zone transfers (one example):

	ods-signerd: [signconf] zone MY.TLD signconf: RESIGN[PT7200S] REFRESH[PT259200S] \
		VALIDITY[PT1209600S] DENIAL[PT1209600S] JITTER[PT43200S] OFFSET[PT3600S] NSEC[50] \
		DNSKEYTTL[PT3600S] SOATTL[PT3600S] MINIMUM[PT3600S] SERIAL[datecounter]
	ods-signerd: [tools] unable to read zone MY.TLD: adapter failed (Incoming zone transfer not ready)

	Clearing /usr/local/var/opendnssec/tmp and restarting opendnssec didn't work, though.

	All failing zones do have TLSA records in contrast to those zones transfering well. Thus I did remove those TLSA records for testing, and yes, now zone transfers work without any issue.

	Questions:

	1) Known issue?
	2) Someone else observing this?
	3) Is nsd to blame? (There has been an upgrade from 4.1.1 in February and opendnssec is from Dec 2014)
	4) Will key rollovers work before having that issue solved? (my ZSK are do to rollover in a couple of days)
	5) What else should I try in order to debug this issue?



Regards and thanks in advance,
Michael