Matthijs Mekking ff4201e388 Lower the maximum allowed NSEC3 iterations to 50 ... BIND 9 will now treat the response as insecure when processing NSEC3 records with iterations larger than 50. Earlier, we limited the number of iterations to 150 (in #2445). RFC 9276 says: Because there has been a large growth of open (public) DNSSEC validating resolvers that are subject to compute resource constraints when handling requests from anonymous clients, this document recommends that validating resolvers reduce their iteration count limits over time. Specifically, validating resolver operators and validating resolver software implementers are encouraged to continue evaluating NSEC3 iteration count deployment trends and lower their acceptable iteration limits over time. After evaluation, we decided that the next major BIND release should lower the maximum allowed NSEC3 iterations to 50, which should be fine for 99,87% of the domain names.		2023-12-05 14:58:58 +00:00
..
dns	Lower the maximum allowed NSEC3 iterations to 50	2023-12-05 14:58:58 +00:00
isc	Cleanup unused stats_bucket() macro	2023-11-29 14:16:20 +01:00
isccc	Limit isccc_cc_fromwire recursion depth	2023-09-07 19:46:19 +02:00
isccfg	dnssec-policy: refuse to load non-zero iterations	2023-12-05 14:58:58 +00:00
ns	Adjust comment to have correct message limit value	2023-11-16 11:22:47 +11:00
.gitignore	The isc/platform.h header has been completely removed	2021-07-06 05:33:48 +00:00
Makefile.am	Move irs_resconf into libdns and remove libirs	2023-02-24 09:38:59 +00:00