<?xml version="1.0" encoding="UTF-8"?>

<!--
  
  NOTE:  The default policy below is a TEMPLATE ONLY and should be reviewed
         before used in any production environment. The administrator should
         consult the OpenDNSSEC documentation before changing any parameters.
         
         If you can read this message, it is likely that this file has not
         been reviewed nor updated.

  -->

<KASP>

	<Policy name="default">
		<Description>A default policy that will amaze you and your friends</Description>
		<Signatures>
			<Resign>PT2H</Resign>
			<Refresh>P3D</Refresh>
			<Validity>
				<Default>P7D</Default>
				<Denial>P7D</Denial>
			</Validity>
			<Jitter>PT12H</Jitter>
			<!-- two hours to avoid daylight saving disasters -->
			<InceptionOffset>PT7200S</InceptionOffset>
		</Signatures>

		<Denial>
			<NSEC3>
				<!-- <OptOut/> -->
				<Resalt>P100D</Resalt>
				<Hash>
					<Algorithm>1</Algorithm>
					<Iterations>5</Iterations>
					<Salt length="8"/>
				</Hash>
			</NSEC3>
		</Denial>

		<Keys>
			<!-- Parameters for both KSK and ZSK -->
			<TTL>PT3600S</TTL>
			<RetireSafety>PT3600S</RetireSafety>
			<PublishSafety>PT3600S</PublishSafety>
			<!-- <ShareKeys/> -->
			<Purge>P14D</Purge>

			<!-- Parameters for KSK only -->
			<KSK>
				<Algorithm length="2048">8</Algorithm>
				<Lifetime>P1Y</Lifetime>
				<Repository>AEP</Repository>
			</KSK>

			<!-- Parameters for ZSK only -->
			<ZSK>
				<Algorithm length="1024">8</Algorithm>
				<Lifetime>P30D</Lifetime>
				<Repository>AEP</Repository>
				<!-- <ManualRollover/> -->
			</ZSK>
		</Keys>

		<Zone>
			<PropagationDelay>PT43200S</PropagationDelay>
			<SOA>
				<TTL>PT3600S</TTL>
				<Minimum>PT3600S</Minimum>
				<Serial>unixtime</Serial>
			</SOA>
		</Zone>

		<Parent>
			<PropagationDelay>PT9999S</PropagationDelay>
			<DS>
				<TTL>PT3600S</TTL>
			</DS>
			<SOA>
				<TTL>PT172800S</TTL>
				<Minimum>PT10800S</Minimum>
			</SOA>
		</Parent>


	</Policy>
</KASP>