upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-06-08 18:32:10 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Document new requirements for 'dnssec-validation yes'

Browse source 
Using the 'dnssec-validation yes' option now requires an explicitly
confgiured 'trust-anchors' statement (or 'managed-keys' or
'trusted-keys', both deprecated).
This commit is contained in:
Aram Sargsyan 2023-12-14 10:42:56 +00:00
parent 4cdef214d2
commit e8fa9aa5c7
2 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
doc/arm/reference.rst
View file

@ -2577,7 +2577,10 @@ Boolean Options
If set to ``yes``, DNSSEC validation is enabled, but a trust anchor must be
manually configured using a :any:`trust-anchors` statement (or the
:any:`managed-keys` or :any:`trusted-keys` statements, both deprecated). If
there is no configured trust anchor, validation does not take place.
:any:`trust-anchors` is not configured, it is a configuration error. If
:any:`trust-anchors` does not include a valid root key, then validation does
not take place for names which are not covered by any of the configured trust
anchors.
If set to ``no``, DNSSEC validation is disabled. (Note: the resolver
will still set the DO bit in outgoing queries indicating that it can

4
doc/dnssec-guide/validation.rst
View file

@ -405,6 +405,10 @@ When set to *auto*, BIND automatically keeps the keys (also known as
trust anchors, discussed in :ref:`trust_anchors_description`)
up-to-date without intervention from the DNS administrator.
When using *yes*, please note that if :any:`trust-anchors` does not include a
valid root key, then validation does not take place for names which are not
covered by any of the configured trust anchors.
We recommend using the default *auto* unless there is a good reason to
require a manual trust anchor. To learn more about trust anchors,
please refer to :ref:`trusted_keys_and_managed_keys`.