Simplify adding CDS and CDNSKEY deletion records to a inline zone.
From bind-users.
There are no DNSKEY records in that zone. CDS and CDNSKEY must be signed for the
parent to accept them. There must be DNSKEY records present for them to be signed.
Add a DNSKEY record to that test zone and it will load.
For inline zone just copy the final DNSKEY RRset from the signed version of the
zone to the raw zone when adding the deletion CDS and CDNSKEY records. Wait for
the parent zone to remove the DS records, then remove the CDS, CDNSKEY, and DNSKEY
records from the raw zone.
Possibly extend rndc signing
to add and remove CDS and CDNSKEY deletion records
from the zone signed zone.
If the DNSKEY RRset becomes empty as a result of key timings remove CDS and CDNSKEY records from the zone.
Edited by Mark Andrews