From 0d8b7ca8513cfe6dd717a2da0ac0fa0350039e03 Mon Sep 17 00:00:00 2001
From: Automatic Updater
- Delegation only. Logs queries that have
- been forced to NXDOMAIN as the result of a
- delegation-only zone or
- a delegation-only in a
- hint or stub zone declaration.
+ Delegation only. Logs queries that have been
+ forced to NXDOMAIN as the result of a
+ delegation-only zone or a
+ delegation-only in a hint
+ or stub zone declaration.
@@ -2367,16 +2367,46 @@ category notify { null; };
in the additional section of a query response.
The default is not to prefer any type (NONE).
- Turn on enforcement of delegation-only in TLDs (top level domains) and root zones - with an optional + Turn on enforcement of delegation-only in TLDs + (top level domains) and root zones with an optional exclude list.
- Note some TLDs are not delegation only (e.g. "DE", "LV", "US" - and "MUSEUM"). + DS queries are expected to be made to and be answered by + delegation only zones. Such queries and responses are + treated as a exception to delegation-only processing + and are not converted to NXDOMAIN responses provided + a CNAME is not discovered at the query name. +
++ If a delegation only zone server also serves a child + zone it is not always possible to determine whether + a answer comes from the delegation only zone or the + child zone. SOA NS and DNSKEY records are apex + only records and a matching response that contains + these records or DS is treated as coming from a + child zone. RRSIG records are also examined to see + if they are signed by a child zone or not. The + authority section is also examined to see if there + is evidence that the answer is from the child zone. + Answers that are determined to be from a child zone + are not converted to NXDOMAIN responses. Despite + all these checks there is still a possibility of + false negatives when a child zone is being served. +
++ Similarly false positives can arise from empty nodes + (no records at the name) in the delegation only zone + when the query type is not ANY. +
++ Note some TLDs are not delegation only (e.g. "DE", "LV", + "US" and "MUSEUM"). This list is not exhaustive.
options {
@@ -3151,7 +3181,7 @@ options {
The forwarding facility can be used to create a large site-wide
cache on a few servers, reducing traffic over links to external
@@ -3195,7 +3225,7 @@ options {
Dual-stack servers are used as servers of last resort to work
around
@@ -3392,7 +3422,7 @@ options {
The interfaces and ports that the server will answer queries
from may be specified using the listen-on option. listen-on takes
@@ -3844,7 +3874,7 @@ avoid-v6-udp-ports {};
use-v4-udp-ports,
avoid-v4-udp-ports,
@@ -3886,7 +3916,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
The server's usage of many system resources can be limited.
Scaled values are allowed when specifying resource limits. For
@@ -4048,7 +4078,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
- cleaning-interval
@@ -5026,7 +5056,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
The statistics-channels statement
@@ -5077,7 +5107,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
trusted-keys {
string number number number string ;
[ string number number number string ; [...]]
@@ -5086,7 +5116,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
The trusted-keys statement defines
@@ -5132,7 +5162,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
The view statement is a powerful
feature
@@ -5398,10 +5428,10 @@ zone zone_name [