dnssec-policy "csk-algoroll" {
	signatures-refresh P5D;
	signatures-validity 30d;
	signatures-validity-dnskey 30d;

	keys {
		csk lifetime unlimited algorithm rsasha256;
	};

	dnskey-ttl 1h;
	publish-safety PT1H;
	retire-safety 2h;
	zone-propagation-delay 3600;
	max-zone-ttl 6h;
	parent-propagation-delay pt1h;
	parent-ds-ttl 7200;
};
