From dab43f84dd4f94b88a82dd086fbdcf6e5379362a Mon Sep 17 00:00:00 2001 From: Matthijs Mekking Date: Wed, 2 Aug 2023 11:16:50 +0200 Subject: [PATCH] Change default TTLsig to one week Commit dc6dafdad1bce4c59bec0dbc355650c384cfc4d9 allows larger TTL values in zones that go insecure, and ignores the maximum zone TTL. This means that if you use TTL values larger than 1 day in your zone, your zone runs the risk of going bogus before it moves safely to insecure. Most resolvers by default cap the maximum TTL that they cache RRsets, at one day (Unbound, Knot, PowerDNS) so that is fine. However, BIND 9's default is one week. Change the default TTLsig to one week, so that also for BIND 9 resolvers in the default cases responses for zones that are going insecure will not be evaluated as bogus. This change does mean that when unsigning your zone, it will take six days longer to safely go insecure, regardless of what TTL values you use in the zone. (cherry picked from commit 32686beabc55727fc56e6fd02953233bf0daa8bd) --- lib/dns/kasp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/dns/kasp.c b/lib/dns/kasp.c index 0cbd0cdc69..d53abfb64c 100644 --- a/lib/dns/kasp.c +++ b/lib/dns/kasp.c @@ -28,7 +28,7 @@ #include /* Default TTLsig (maximum zone ttl) */ -#define DEFAULT_TTLSIG 86400 +#define DEFAULT_TTLSIG 604800 /* one week */ isc_result_t dns_kasp_create(isc_mem_t *mctx, const char *name, dns_kasp_t **kaspp) {