upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-01-18 04:32:54 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

- Fix #986: Resolving sas.com with dnssec-validation fails though

Browse source 
signed delegations seem to be (mostly) correct.
This commit is contained in:
W.C.A. Wijngaards 2025-01-30 16:26:31 +01:00
parent 35dbbcb2f5
commit 01cea4d5be
2 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
doc/Changelog
View file

@ -1,3 +1,7 @@
30 January 2025: Wouter
- Fix #986: Resolving sas.com with dnssec-validation fails though
signed delegations seem to be (mostly) correct.
29 January 2025: Yorgos
- Make the default value of module-config "validator iterator"
regardless of compilation options. --enable-subnet would implicitly

2
doc/unbound.conf.5.in
View file

@ -1111,7 +1111,7 @@ This works by first choosing only the strongest DS digest type as per RFC 4509
(Unbound treats the highest algorithm as the strongest) and then
expecting signatures from all the advertised signing algorithms from the chosen
DS(es) to be present.
If no, allows any algorithm to validate the zone.
If no, allows any one supported algorithm to validate the zone, even if other advertised algorithms are broken.
Default is no.
RFC 6840 mandates that zone signers must produce zones signed with all
advertised algorithms, but sometimes they do not.