We had an incident two weeks ago with our DNSSEC signing system causing it to accidentally release a new Zone-signing-key into our live zone file. We have spent the last two weeks looking into how this may have happened and have produced a report (attached) that helps explain what we have found and some of the new procedures we have put in place to prevent a re-occurrence.
Many thanks to those of you who helped us in both diagnosing the incident and making some really useful suggestions as to causes and procedure changes. Your input was enormously helpful.
Simon.
