mirror of
https://github.com/isc-projects/bind9.git
synced 2026-03-25 20:04:05 -04:00
When a mirror zone is verified, the 'ignore_kskflag' argument passed to dns_zoneverify_dnssec() is set to false. This means that in order for its verification to succeed, a mirror zone needs to have at least one key with the SEP bit set configured as a trust anchor. This brings no security benefit and prevents zones signed only using keys without the SEP bit set from being mirrored, so change the value of the 'ignore_kskflag' argument passed to dns_zoneverify_dnssec() to true. |
||
|---|---|---|
| .. | ||
| bigtest | ||
| optional | ||
| pkcs11 | ||
| startperf | ||
| system | ||
| testdata/wire | ||
| virtual-time | ||
| win32 | ||
| .gitignore | ||
| cfg_test.c | ||
| fromhex.pl | ||
| headerdep_test.sh.in | ||
| Makefile.in | ||
| makejournal.c | ||
| named.conf | ||
| wire_test.c | ||