Luckily I have some historic .ch zone data laying around, so I did a quick analysis of the number of ALG-7 / ALG-5 / DS-1 domains, please find the numbers below.
Seems the wipe-out has been performed in chunks, maybe by registrar. SWITCH willing to share some info?
Also interesing to see that the number of DS-1 hashes in the .ch zone file is raising again. All coming from hosttech. Though by now it seems these are not published anymore.
Gruass, Franco
DATE ALG-7 ALG-5 DS-1 ==== ===== ===== ==== 2023-04-01 530 41 59645 2023-04-02 529 41 59627 2023-04-03 528 41 59466 2023-04-04 527 41 59443 2023-04-05 527 41 59427 2023-04-06 527 41 59394 2023-04-07 526 41 59383 2023-04-08 526 41 59354 2023-04-09 524 41 59332 2023-04-10 524 41 59315 2023-04-11 524 41 59274 2023-04-12 278 28 58756 2023-04-13 279 28 58733 2023-04-14 272 22 57566 2023-04-15 269 22 57543 2023-04-16 269 22 57529 2023-04-17 269 22 57504 2023-04-18 72 19 309 2023-04-19 10 7 133 2023-04-20 10 7 135 2023-04-21 10 7 147 2023-04-22 7 4 88 2023-04-23 7 4 92 2023-04-24 7 4 92 2023-04-25 7 4 91 2023-04-26 7 4 97 2023-04-27 7 4 98 2023-04-28 0 0 0 2023-04-29 0 0 0 2023-04-30 0 0 1 2023-05-01 0 0 1 2023-05-02 0 0 5
caroule-music.ch. 3600 IN DS 7321 8 1 FF2BCD11DBBEB58B15CE581AC4D0B4F0FA7B5AC8 caroulemusic.ch. 3600 IN DS 49924 8 1 B23CB635433B6DF5893FE94BD7F27B91DED2FD3C datalawyer.ch. 3600 IN DS 49765 8 1 73CD7B42648847E43C2CF6A1E4F2680F8C0C20A4 digilawyer.ch. 3600 IN DS 13045 8 1 A5E02D7FF95BACE907F93197A23E45CB65DFF838 workforceag.ch. 3600 IN DS 49996 8 1 98B42F52FE01CB6E593CB463C11E3C602C6F2BB1
On 01.05.23 17:33, Franco Hug wrote:
Thanks Daniel for your helpful answers. Yes, CDS is also something I always wanted to try, but as usual: no hard pressure, no time... ;-)
Benoît Panizzon wrote:
From their point of view, my 'algo 5' .ch domains have still DNSSEC active
Basically the same behavior I had with my 'algo 7' domains (infomaniak).
but deleting DS or disabling DNSSEC hangs forever and upon reloading my old algo 5 keys are back.
I did not even try to delete/disable DNSSEC, I was just able to update the existing record (key/algo/hash). Then the update towards the registry was carried out immediately, seems the old values do not matter then. Cannot tell whether that works with Gandi though.
Maybe option #3 besides the nerd and normal answers and worth a try?
Gruass, Franco