dnssec-policy "unlimited" {
	dnskey-ttl 1234;

	keys {
		csk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
	};
};

dnssec-policy "default-dynamic" {
	inline-signing no;
};

dnssec-policy "migrate-to-dnssec-policy" {
	dnskey-ttl 1234;

	keys {
		ksk key-directory lifetime P6M algorithm 8;
		zsk key-directory lifetime P6M algorithm 8;
	};
};

dnssec-policy "rsasha256" {
	dnskey-ttl 1234;

	keys {
		ksk key-directory lifetime P10Y algorithm 8;
		zsk key-directory lifetime P5Y  algorithm 8;
		zsk key-directory lifetime P1Y  algorithm 8 3072;
	};
};

dnssec-policy "rsasha512" {
	dnskey-ttl 1234;

	keys {
		ksk key-directory lifetime P10Y algorithm 10;
		zsk key-directory lifetime P5Y  algorithm 10;
		zsk key-directory lifetime P1Y  algorithm 10 3072;
	};
};

dnssec-policy "ecdsa256" {
	dnskey-ttl 1234;

	keys {
		ksk key-directory lifetime P10Y algorithm 13;
		zsk key-directory lifetime P5Y  algorithm 13;
		zsk key-directory lifetime P1Y  algorithm 13 256;
	};
};

dnssec-policy "ecdsa384" {
	dnskey-ttl 1234;

	keys {
		ksk key-directory lifetime P10Y algorithm 14;
		zsk key-directory lifetime P5Y  algorithm 14;
		zsk key-directory lifetime P1Y  algorithm 14 384;
	};
};

dnssec-policy "checkds-ksk" {
	dnskey-ttl 303;

	keys {
		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
	};
};

dnssec-policy "checkds-doubleksk" {
	dnskey-ttl 303;

	keys {
		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
	};
};

dnssec-policy "checkds-csk" {
	dnskey-ttl 303;

	keys {
		csk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
	};
};

dnssec-policy "ttl" {
	max-zone-ttl 299;
};

key-store "ksk" {
	directory "ksk";
};

key-store "zsk" {
	directory "zsk";
};

dnssec-policy "keystore" {
	dnskey-ttl 303;

	keys {
		ksk key-store "ksk" lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
		zsk key-store "zsk" lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
	};
};
