upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2025-12-20 23:00:56 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

More design choice explanation.

Browse source 
git-svn-id: file:///svn/unbound/trunk@1934 be551aaa-1e26-0410-a405-d3ace91eadb9
This commit is contained in:
Wouter Wijngaards 2009-12-10 10:23:51 +00:00
parent 1d2c4f70fa
commit e43b2c9338
2 changed files with 24 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
doc/Changelog
View file

@ -1,3 +1,6 @@
10 December 2009: Wouter
- requirements.txt updated with design choice explanations.
9 December 2009: Wouter 9 December 2009: Wouter
- Fix Bug#287(reopened): update of ldns tarball with fix for parse - Fix Bug#287(reopened): update of ldns tarball with fix for parse
errors generated for domain names like '.example.com'. errors generated for domain names like '.example.com'.

21
doc/requirements.txt
View file

@ -260,3 +260,24 @@ o NXDOMAIN and SOA serial numbers.
updated more carefully. If one of the NSEC records in an NXDOMAIN is updated more carefully. If one of the NSEC records in an NXDOMAIN is
updated from another query, the NXDOMAIN is dropped from the cache, updated from another query, the NXDOMAIN is dropped from the cache,
and queried for again, so that its proof can be checked again. and queried for again, so that its proof can be checked again.
o SOA records in negative cached answers for DS queries.
The current unbound code uses a negative cache for queries for type DS.
This speeds up building chains of trust, and uses NSEC and NSEC3
(optout) information to speed up lookups. When used internally,
the bare NSEC(3) information is sufficient, probably picked up from
a referral. When answering to clients, a SOA record is needed for
the correct message format, a SOA record is picked from the cache
(and may not actually match the serial number of the SOA for which the
NSEC and NSEC3 records were obtained) if available otherwise network
queries are performed to get the data.
o Parent and child with different nameserver information.
A misconfiguration that sometimes happens is where the parent and child
have different NS, glue information. The child is authoritative, and
unbound will not trust information from the parent nameservers as the
final answer. To help lookups, unbound will however use the parent-side
version of the glue as a last resort lookup. This resolves lookups for
those misconfigured domains where the servers reported by the parent
are the only ones working, and servers reported by the child do not.