upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-05-23 18:47:40 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 4
bind9/bind.keys

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

44 lines
2 KiB
Text
Raw Normal View History

[master] de-DLV 4749. [func] The ISC DLV service has been shut down, and all DLV records have been removed from dlv.isc.org. - Removed references to ISC DLV in documentation - Removed DLV key from bind.keys - No longer use ISC DLV by default in delv [RT #46155]
2017-10-03 03:28:31 -04:00
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
Update the copyright information in all files in the repository This commit converts the license handling to adhere to the REUSE specification. It specifically: 1. Adds used licnses to LICENSES/ directory 2. Add "isc" template for adding the copyright boilerplate 3. Changes all source files to include copyright and SPDX license header, this includes all the C sources, documentation, zone files, configuration files. There are notes in the doc/dev/copyrights file on how to add correct headers to the new files. 4. Handle the rest that can't be modified via .reuse/dep5 file. The binary (or otherwise unmodifiable) files could have license places next to them in <foo>.license file, but this would lead to cluttered repository and most of the files handled in the .reuse/dep5 file are system test files.
2021-06-03 02:37:05 -04:00
#
Set "dnssec-validation auto" by default - the default setting for dnssec-validation is now "auto", which activates DNSSEC validation using the IANA root key. The old behavior can be restored by explicitly setting "dnssec-validation yes", which "yes", which activates DNSSEC validation only if keys are explicitly configured in named.conf. - the ARM has been updated to describe the new behavior
2018-05-16 14:58:15 -04:00
# SPDX-License-Identifier: MPL-2.0
Update the copyright information in all files in the repository This commit converts the license handling to adhere to the REUSE specification. It specifically: 1. Adds used licnses to LICENSES/ directory 2. Add "isc" template for adding the copyright boilerplate 3. Changes all source files to include copyright and SPDX license header, this includes all the C sources, documentation, zone files, configuration files. There are notes in the doc/dev/copyrights file on how to add correct headers to the new files. 4. Handle the rest that can't be modified via .reuse/dep5 file. The binary (or otherwise unmodifiable) files could have license places next to them in <foo>.license file, but this would lead to cluttered repository and most of the files handled in the .reuse/dep5 file are system test files.
2021-06-03 02:37:05 -04:00
#
update bind.keys comments
2019-03-19 00:19:40 -04:00
# This Source Code Form is subject to the terms of the Mozilla Public
[master] de-DLV 4749. [func] The ISC DLV service has been shut down, and all DLV records have been removed from dlv.isc.org. - Removed references to ISC DLV in documentation - Removed DLV key from bind.keys - No longer use ISC DLV by default in delv [RT #46155]
2017-10-03 03:28:31 -04:00
# License, v. 2.0. If a copy of the MPL was not distributed with this
update bind.keys comments
2019-03-19 00:19:40 -04:00
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
Update the copyright information in all files in the repository This commit converts the license handling to adhere to the REUSE specification. It specifically: 1. Adds used licnses to LICENSES/ directory 2. Add "isc" template for adding the copyright boilerplate 3. Changes all source files to include copyright and SPDX license header, this includes all the C sources, documentation, zone files, configuration files. There are notes in the doc/dev/copyrights file on how to add correct headers to the new files. 4. Handle the rest that can't be modified via .reuse/dep5 file. The binary (or otherwise unmodifiable) files could have license places next to them in <foo>.license file, but this would lead to cluttered repository and most of the files handled in the .reuse/dep5 file are system test files.
2021-06-03 02:37:05 -04:00
#
Set "dnssec-validation auto" by default - the default setting for dnssec-validation is now "auto", which activates DNSSEC validation using the IANA root key. The old behavior can be restored by explicitly setting "dnssec-validation yes", which "yes", which activates DNSSEC validation only if keys are explicitly configured in named.conf. - the ARM has been updated to describe the new behavior
2018-05-16 14:58:15 -04:00
# See the COPYRIGHT file distributed with this work for additional
update bind.keys comments
2019-03-19 00:19:40 -04:00
# information regarding copyright ownership.
Update the copyright information in all files in the repository This commit converts the license handling to adhere to the REUSE specification. It specifically: 1. Adds used licnses to LICENSES/ directory 2. Add "isc" template for adding the copyright boilerplate 3. Changes all source files to include copyright and SPDX license header, this includes all the C sources, documentation, zone files, configuration files. There are notes in the doc/dev/copyrights file on how to add correct headers to the new files. 4. Handle the rest that can't be modified via .reuse/dep5 file. The binary (or otherwise unmodifiable) files could have license places next to them in <foo>.license file, but this would lead to cluttered repository and most of the files handled in the .reuse/dep5 file are system test files.
2021-06-03 02:37:05 -04:00
clean up bind.keys the comments in the bind.keys file were outdated; the file now only exists to be converted into bind.keys.h and compiled into named and delv. some tests also referenced it, and have been cleaned up, since the keys in it are already built into named.
2025-10-10 20:41:07 -04:00
# This file contains trust anchors for the DNS root zone (".") which are
# compiled into named and delv. No other trust anchors can be configured
# here.
3001. [func] Added a default trust anchor for the root zone, which can be switched on by setting "dnssec-validation auto;" in the named.conf options. [RT #21727]
2011-01-03 18:45:08 -05:00
#
clean up bind.keys the comments in the bind.keys file were outdated; the file now only exists to be converted into bind.keys.h and compiled into named and delv. some tests also referenced it, and have been cleaned up, since the keys in it are already built into named.
2025-10-10 20:41:07 -04:00
# These keys are current as of October 2025. If any key fails to
Add the DS for the new root key (38696) Add an 'initial-ds' entry to bind.keys for the new root key, ID 38696, scheduled for publication in January 2025.
2024-08-26 15:13:09 -04:00
# initialize correctly, it may have expired. This should not occur if
# BIND is kept up to date.
update bind.keys comments
2019-03-19 00:19:40 -04:00
#
# See https://data.iana.org/root-anchors/root-anchors.xml for current trust
# anchor information for the root zone.
3001. [func] Added a default trust anchor for the root zone, which can be switched on by setting "dnssec-validation auto;" in the named.conf options. [RT #21727]
2011-01-03 18:45:08 -05:00
introduce default config builtin-root-anchors Since the effective configuration tree is a "merged" configuration tree from the user and the default configurations, the effective configuration provides a unique configuration tree used by apply_confiuration() to configure the server. However, there is one specific case where the configuration code needs to differentiate whether the configuration originally came from the default or the user configuration: the trust-anchors. This is because the default trust-anchors _have_ to be those for the root zone, and the one provided by the user can be for any zone. A check enforces this. In order to keep this difference visible from the configuration code, with a unique configuration tree, we now introduce a default-only `builtin-trust-anchors` statement which holds the builtin root trust-anchors. It can't be used from the user configuration (this would raise an error), hence it is not documented.
2025-10-13 10:00:17 -04:00
builtin-trust-anchors {
Add the DS for the new root key (38696) Add an 'initial-ds' entry to bind.keys for the new root key, ID 38696, scheduled for publication in January 2025.
2024-08-26 15:13:09 -04:00
# This key (20326) was published in the root zone in 2017, and
# is scheduled to be phased out starting in 2025. It will remain
# in the root zone until some time after its successor key has
# been activated. It will remain this file until it is removed
# from the root zone.
4564. [maint] Update the built in managed keys to include the upcoming root KSK. [RT #44579]
2017-02-02 01:32:23 -05:00
. initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
R1AkUTV74bU=";
Add the DS for the new root key (38696) Add an 'initial-ds' entry to bind.keys for the new root key, ID 38696, scheduled for publication in January 2025.
2024-08-26 15:13:09 -04:00
# This key (38696) will be pre-published in the root zone in 2025
# and is scheduled to begin signing in late 2026. At that time,
# servers which were already using the old key (20326) should roll
# seamlessly to this new one via RFC 5011 rollover.
. initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A
4C0FB2B16";
2572. [func] Simplify DLV configuration, with a new option "dnssec-lookaside auto;" This is the equivalent of "dnssec-lookaside . trust-anchor dlv.isc.org;" plus setting a trusted-key for dlv.isc.org. Note: The trusted key is hard-coded into named, but is also stored in (and can be overridden by) $sysconfdir/bind.keys. As the ISC DLV key rolls over it can be kept up to date by replacing the bind.keys file with a key downloaded from https://www.isc.org/solutions/dlv. [RT #18685]
2009-03-03 21:42:31 -05:00
};
Reference in a new issue Copy permalink