DNSSEC-signed zones are resigned at every daemon start
Jul 15 18:12:48 earth.rfc1925.org knotd[30130]: 2017-07-15T18:12:48 info: [vcelareninaboso.cz.] changes from journal applied 1499841519 -> 1499946833
Jul 15 18:12:48 earth.rfc1925.org knotd[30130]: 2017-07-15T18:12:48 info: [vcelareninaboso.cz.] DNSSEC, loaded key, tag 29847, algorithm 13, KSK yes, ZSK no, public yes, ready yes, active yes
Jul 15 18:12:48 earth.rfc1925.org knotd[30130]: 2017-07-15T18:12:48 info: [vcelareninaboso.cz.] DNSSEC, loaded key, tag 6166, algorithm 13, KSK yes, ZSK no, public yes, ready yes, active no
Jul 15 18:12:48 earth.rfc1925.org knotd[30130]: 2017-07-15T18:12:48 info: [vcelareninaboso.cz.] DNSSEC, loaded key, tag 20730, algorithm 13, KSK no, ZSK yes, public yes, ready yes, active yes
Jul 15 18:12:48 earth.rfc1925.org knotd[30130]: 2017-07-15T18:12:48 info: [vcelareninaboso.cz.] DNSSEC, signing started
Jul 15 18:12:48 earth.rfc1925.org knotd[30130]: 2017-07-15T18:12:48 info: [vcelareninaboso.cz.] DNSSEC, zone is up-to-date
Jul 15 18:12:48 earth.rfc1925.org knotd[30130]: 2017-07-15T18:12:48 info: [vcelareninaboso.cz.] loaded, serial 1499946833
Jul 15 18:12:48 earth.rfc1925.org knotd[30130]: 2017-07-15T18:12:48 info: [vcelareninaboso.cz.] DNSSEC, next signing at 2017-07-18T16:14:03
Jul 15 18:12:49 earth.rfc1925.org knotd[30130]: 2017-07-15T18:12:49 info: [vcelareninaboso.cz.] notify, outgoing, 81.91.84.116@53: serial 1499946833
Jul 15 18:12:49 earth.rfc1925.org knotd[30130]: 2017-07-15T18:12:49 info: [vcelareninaboso.cz.] notify, outgoing, 45.76.92.7@53: serial 1499946833
Jul 15 18:12:49 earth.rfc1925.org knotd[30130]: 2017-07-15T18:12:49 info: [vcelareninaboso.cz.] DNSSEC, loaded key, tag 29847, algorithm 13, KSK yes, ZSK no, public yes, ready yes, active yes
Jul 15 18:12:49 earth.rfc1925.org knotd[30130]: 2017-07-15T18:12:49 info: [vcelareninaboso.cz.] DNSSEC, loaded key, tag 6166, algorithm 13, KSK yes, ZSK no, public yes, ready yes, active no
Jul 15 18:12:49 earth.rfc1925.org knotd[30130]: 2017-07-15T18:12:49 info: [vcelareninaboso.cz.] DNSSEC, loaded key, tag 20730, algorithm 13, KSK no, ZSK yes, public yes, ready yes, active yes
Jul 15 18:12:49 earth.rfc1925.org knotd[30130]: 2017-07-15T18:12:49 info: [vcelareninaboso.cz.] parent DS check, outgoing, ::1@53: KSK submission attempt: negative
Jul 15 18:12:49 earth.rfc1925.org knotd[30130]: 2017-07-15T18:12:49 info: [vcelareninaboso.cz.] parent DS check, outgoing, 127.0.0.1@53: KSK submission attempt: negative
and
# systemctl restart knot
root@earth:~# Jul 15 18:13:56 earth.rfc1925.org knotd[30153]: 2017-07-15T18:13:56 info: [vcelareninaboso.cz.] zone will be loaded
Jul 15 18:13:57 earth.rfc1925.org knotd[30153]: 2017-07-15T18:13:57 info: [vcelareninaboso.cz.] changes from journal applied 1499841519 -> 1499946833
Jul 15 18:13:57 earth.rfc1925.org knotd[30153]: 2017-07-15T18:13:57 info: [vcelareninaboso.cz.] DNSSEC, loaded key, tag 29847, algorithm 13, KSK yes, ZSK no, public yes, ready yes, active yes
Jul 15 18:13:57 earth.rfc1925.org knotd[30153]: 2017-07-15T18:13:57 info: [vcelareninaboso.cz.] DNSSEC, loaded key, tag 6166, algorithm 13, KSK yes, ZSK no, public yes, ready yes, active no
Jul 15 18:13:57 earth.rfc1925.org knotd[30153]: 2017-07-15T18:13:57 info: [vcelareninaboso.cz.] DNSSEC, loaded key, tag 20730, algorithm 13, KSK no, ZSK yes, public yes, ready yes, active yes
Jul 15 18:13:57 earth.rfc1925.org knotd[30153]: 2017-07-15T18:13:57 info: [vcelareninaboso.cz.] DNSSEC, signing started
Jul 15 18:13:57 earth.rfc1925.org knotd[30153]: 2017-07-15T18:13:57 info: [vcelareninaboso.cz.] DNSSEC, zone is up-to-date
Jul 15 18:13:57 earth.rfc1925.org knotd[30153]: 2017-07-15T18:13:57 info: [vcelareninaboso.cz.] loaded, serial 1499946833
Jul 15 18:13:57 earth.rfc1925.org knotd[30153]: 2017-07-15T18:13:57 info: [vcelareninaboso.cz.] DNSSEC, next signing at 2017-07-18T16:14:03
Jul 15 18:13:57 earth.rfc1925.org knotd[30153]: 2017-07-15T18:13:57 info: [vcelareninaboso.cz.] notify, outgoing, 81.91.84.116@53: serial 1499946833
Jul 15 18:13:57 earth.rfc1925.org knotd[30153]: 2017-07-15T18:13:57 info: [vcelareninaboso.cz.] notify, outgoing, 45.76.92.7@53: serial 1499946833
Jul 15 18:13:58 earth.rfc1925.org knotd[30153]: 2017-07-15T18:13:58 info: [vcelareninaboso.cz.] DNSSEC, loaded key, tag 29847, algorithm 13, KSK yes, ZSK no, public yes, ready yes, active yes
Jul 15 18:13:58 earth.rfc1925.org knotd[30153]: 2017-07-15T18:13:58 info: [vcelareninaboso.cz.] DNSSEC, loaded key, tag 6166, algorithm 13, KSK yes, ZSK no, public yes, ready yes, active no
Jul 15 18:13:58 earth.rfc1925.org knotd[30153]: 2017-07-15T18:13:58 info: [vcelareninaboso.cz.] DNSSEC, loaded key, tag 20730, algorithm 13, KSK no, ZSK yes, public yes, ready yes, active yes
Jul 15 18:13:58 earth.rfc1925.org knotd[30153]: 2017-07-15T18:13:58 info: [vcelareninaboso.cz.] parent DS check, outgoing, ::1@53: KSK submission attempt: negative
Jul 15 18:13:58 earth.rfc1925.org knotd[30153]: 2017-07-15T18:13:58 info: [vcelareninaboso.cz.] parent DS check, outgoing, 127.0.0.1@53: KSK submission attempt: negative
I can reproduce with 2.5
and master
branches.