dnssec-importkey — Import DNSKEY records from external systems so they can be managed.
+dnssec-importkey — import DNSKEY records from external systems so they can be managed
dnssec-revoke — Set the REVOKED bit on a DNSSEC key
+dnssec-revoke — set the REVOKED bit on a DNSSEC key
dnssec-settime — Set the key timing metadata for a DNSSEC key
+dnssec-settime — set the key timing metadata for a DNSSEC key
dnssec-checkds — A DNSSEC delegation consistency checking tool.
+dnssec-checkds — DNSSEC delegation consistency checking tool
named-rrchecker — A syntax checker for individual DNS resource records
+named-rrchecker — syntax checker for individual DNS resource records
As a slave zone can also be a master to other slaves, named, by default, sends NOTIFY messages for every zone it loads. Specifying notify master-only; will cause named to only send NOTIFY for master zones that it loads. -
None of the keys listed in this example are valid. In particular, the root key is not valid. -
When DNSSEC validation is enabled and properly configured,
the resolver will reject any answers from signed, secure zones
@@ -1609,12 +1613,14 @@ $ /opt/pkcs11/usr/bin/softhsm-util --init-token
The latest OpenSSL versions as of this writing (January 2015) are 0.9.8zc, 1.0.0o, and 1.0.1j. ISC will provide updated patches as new versions of OpenSSL are released. The version number in the following examples is expected to change. -
Before building BIND 9 with PKCS#11 support, it will be
necessary to build OpenSSL with the patch in place, and configure
@@ -1637,10 +1643,12 @@ $
+ The patch file may not be compatible with the
"patch" utility on all operating systems. You may need to
install GNU patch.
- patch -p1 -d openssl-0.9.8zc \
Note
- Note that the patch file may not be compatible with the
+
When building OpenSSL, place it in a non-standard location so that it does not interfere with OpenSSL libraries diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html index c72b3de5e0..976f31d921 100644 --- a/doc/arm/Bv9ARM.ch06.html +++ b/doc/arm/Bv9ARM.ch06.html @@ -3580,7 +3580,6 @@ options { queries. Caching may still occur as an effect the server's internal operation, such as NOTIFY address lookups. - See also fetch-glue above.
@@ -4898,13 +4897,15 @@ avoid-v6-udp-ports {};
If you do not wish the alternate transfer source to be used, you should set use-alt-transfer-source appropriately and you should not depend upon getting an answer back to the first refresh query. -
@@ -6234,11 +6235,13 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
The real parent servers for these zones should disable all empty zone under the parent zone they serve. For the real root servers, this is all built-in empty zones. This will enable them to return referrals to deeper in the tree. -
@@ -8924,7 +8927,7 @@ example.com. NS ns2.example.net.
The name field
is subject to DNS wildcard expansion, and
this rule matches when the name being updated
- name is a valid expansion of the wildcard.
+ is a valid expansion of the wildcard.
+ If the named daemon is running as an unprivileged user, it will not be able to bind to new restricted ports if the server is reloaded. -
An incorrect boundary check in the OPENPGPKEY rdatatype @@ -194,6 +194,9 @@
+ Updated the complied in addresses for H.ROOT-SERVERS.NET. +
Large inline-signing changes should be less disruptive.
Signature generation is now done incrementally; the number
diff --git a/doc/arm/Bv9ARM.ch12.html b/doc/arm/Bv9ARM.ch12.html
index 598e95f92a..3e73966494 100644
--- a/doc/arm/Bv9ARM.ch12.html
+++ b/doc/arm/Bv9ARM.ch12.html
@@ -432,9 +432,13 @@ $ make
+ In practice, either -a or -r must be specified. Others can + be optional; the underlying library routine tries to identify the + appropriate server and the zone name for the update. +
+Examples: assuming the primary authoritative server of the dynamic.example.com zone has an IPv6 address 2001:db8::1234, diff --git a/doc/arm/Bv9ARM.ch13.html b/doc/arm/Bv9ARM.ch13.html index 5a5d3892d2..f2ca00db02 100644 --- a/doc/arm/Bv9ARM.ch13.html +++ b/doc/arm/Bv9ARM.ch13.html @@ -57,7 +57,7 @@ delv — DNS lookup and validation utility
dnssec-checkds — A DNSSEC delegation consistency checking tool.
+dnssec-checkds — DNSSEC delegation consistency checking tool
dnssec-importkey — Import DNSKEY records from external systems so they can be managed.
+dnssec-importkey — import DNSKEY records from external systems so they can be managed
dnssec-revoke — Set the REVOKED bit on a DNSSEC key
+dnssec-revoke — set the REVOKED bit on a DNSSEC key
dnssec-settime — Set the key timing metadata for a DNSSEC key
+dnssec-settime — set the key timing metadata for a DNSSEC key
named-rrchecker — A syntax checker for individual DNS resource records
+named-rrchecker — syntax checker for individual DNS resource records
An incorrect boundary check in the OPENPGPKEY rdatatype @@ -155,6 +155,9 @@
+ Updated the complied in addresses for H.ROOT-SERVERS.NET. +
Large inline-signing changes should be less disruptive. Signature generation is now done incrementally; the number