Lomedhi

That would make sense. The domains on this server were transferred from other servers using Transfer Virtual Server in Virtualmin when I migrated from Vultr to SSD Nodes. That calls Webmin's backup and restore scripts, right? On 2022-05-14 00:00, Jamie Cameron wrote: Looks like this can happen if a domain was backed up and restored, as this will lead to incorrect ownership of the key files. This will be fixed in the next release of Virtualmin. [bugs:#5555] https://sourceforge.net/p/webadmin/bugs/5555/...

Okay, yesterday it happened again, on a different server. I've checked that there are no .key or .private ownership problems. It looks like it was associated with a Let's Encrypt renewal. The domain was not due for re-signing, but RRSIG and NSEC3 records changed. Fixed by manual "Sign Zone". Sending you a private message with the details.

Okay, yesterday it happened again, on a different server. I've checked that there are no .key or .private ownership problems. It looks like it was associated with a Let's Encrypt renewal. The domain was not due for re-signing, but RRSIG and NSEC3 records changed. Fixed by manual "Sign Zone". DNSSEC results: andycrooksyyc.com: ; fully validated andycrooksyyc.com. 300 IN SOA vivaldi.keenmouse.com. admin.keenmouse.com. 1636397181 3600 600 1209600 3600 andycrooksyyc.com. 300 IN RRSIG SOA 14 2 300 20220611145106...

That would make sense. The domains on this server were transferred from other servers using Transfer Virtual Server in Virtualmin when I migrated from Vultr to SSD Nodes. That calls Webmin's backup and restore scripts, right? Jim Grusendorf President Keen Mouse Productions Inc. https://keenmouse.com jgrusendorf@keenmouse.com Keen Mouse Productions Inc. <http://keenmouse.com> On 2022-05-14 00:00, Jamie Cameron wrote: Looks like this can happen if a domain was backed up and restored, as this will lead...

I've had this happen again. Sent you a private message with the details. The re-signing itself seems to be fine, but DNSSEC becomes invalid later, and I don't understand why. It happens sporadically with multiple domains on multiple Webmin servers.

Okay, I found that I can get output with resign.pl --debug. I just shortened my period between re-signs to force re-signing and all zones were re-signed successfully. I don't know what's causing the problem, but UptimeRobot keeps telling me occasionally that a site is down. When I check it, the DNSSEC/DANE Validator Firefox extension tells me that DNSSEC is failing. I manually re-sign the zone and then DNSSEC passes and UptimeRobot says the site is up again. I will add the --debug flag to the cron...

DNSSEC key re-signing not happening

Okay, I have ManageSieve working, so I'll try that.