diff --git a/bin/named/named.conf.5 b/bin/named/named.conf.5 index 88cfb1aea7..bb45140d53 100644 --- a/bin/named/named.conf.5 +++ b/bin/named/named.conf.5 @@ -451,6 +451,7 @@ options { stacksize ( default | unlimited | \fIsizeval\fR ); startup\-notify\-rate \fIinteger\fR; statistics\-file \fIquoted_string\fR; + synth\-from\-dnssec \fIboolean\fR; tcp\-advertised\-timeout \fIinteger\fR; tcp\-clients \fIinteger\fR; tcp\-idle\-timeout \fIinteger\fR; @@ -801,6 +802,7 @@ view \fIstring\fR [ \fIclass\fR ] { sig\-signing\-type \fIinteger\fR; sig\-validity\-interval \fIinteger\fR [ \fIinteger\fR ]; sortlist { \fIaddress_match_element\fR; \&.\&.\&. }; + synth\-from\-dnssec \fIboolean\fR; transfer\-format ( many\-answers | one\-answer ); transfer\-source ( \fIipv4_address\fR | * ) [ port ( \fIinteger\fR | * ) ] [ dscp \fIinteger\fR ]; diff --git a/bin/named/named.conf.html b/bin/named/named.conf.html index 7e4c44b5e8..2a20bfe78d 100644 --- a/bin/named/named.conf.html +++ b/bin/named/named.conf.html @@ -428,6 +428,7 @@ options stacksize ( default | unlimited | sizeval );
startup-notify-rate integer;
statistics-file quoted_string;
+ synth-from-dnssec boolean;
tcp-advertised-timeout integer;
tcp-clients integer;
tcp-idle-timeout integer;
@@ -766,6 +767,7 @@ view sig-signing-type integer;
sig-validity-interval integer [ integer ];
sortlist { address_match_element; ... };
+ synth-from-dnssec boolean;
transfer-format ( many-answers | one-answer );
transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
    dscp integer ];
diff --git a/doc/arm/Bv9ARM.ch04.html b/doc/arm/Bv9ARM.ch04.html index c9fd498861..b3eb8278c3 100644 --- a/doc/arm/Bv9ARM.ch04.html +++ b/doc/arm/Bv9ARM.ch04.html @@ -229,7 +229,7 @@

Changes that result from incoming incremental zone transfers are also - journalled in a similar way. + journaled in a similar way.

@@ -987,7 +987,7 @@ allow-update { !{ !localnets; any; }; key host1-host2. ;};

Any keyset files corresponding to - secure subzones should be present. The zone signer will + secure sub-zones should be present. The zone signer will generate NSEC, NSEC3 and RRSIG records for the zone, as well as DS for the child zones if diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html index 5045452ead..fb21d8b070 100644 --- a/doc/arm/Bv9ARM.ch06.html +++ b/doc/arm/Bv9ARM.ch06.html @@ -5032,6 +5032,37 @@ options { next time named is started.

+
synth-from-dnssec
+
+

+ Synthesize answers from cached NSEC, NSEC3 and + other RRsets that have been proved to be correct + using DNSSEC. The default is yes. +

+

+ Note: +

+
+

+

+
diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html index 511404d9bd..7fd456230a 100644 --- a/doc/arm/Bv9ARM.ch09.html +++ b/doc/arm/Bv9ARM.ch09.html @@ -442,6 +442,21 @@ "[ECS address/source/scope]".

+
  • +

    + named will now synthesize responses + from cached DNSSEC-verified records. This will reduce + query loads on authoritative servers for signed domains: + if existing cached records can be used to determine + the answer then no query needs to be sent. +

    +

    + This behavior is controlled by the new + named.conf option + synth-from-dnssec. It is enabled by + default. +

    +
    • diff --git a/doc/arm/man.named.conf.html b/doc/arm/man.named.conf.html index 05fb06d8ec..6ba590326c 100644 --- a/doc/arm/man.named.conf.html +++ b/doc/arm/man.named.conf.html @@ -446,6 +446,7 @@ options stacksize ( default | unlimited | sizeval );
    startup-notify-rate integer;
    statistics-file quoted_string;
    + synth-from-dnssec boolean;
    tcp-advertised-timeout integer;
    tcp-clients integer;
    tcp-idle-timeout integer;
    @@ -784,6 +785,7 @@ view sig-signing-type integer;
    sig-validity-interval integer [ integer ];
    sortlist { address_match_element; ... };
    + synth-from-dnssec boolean;
    transfer-format ( many-answers | one-answer );
    transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
        dscp integer     ];
    diff --git a/doc/arm/notes.html b/doc/arm/notes.html index a0d76bab54..586336edbd 100644 --- a/doc/arm/notes.html +++ b/doc/arm/notes.html @@ -403,6 +403,21 @@ "[ECS address/source/scope]".

    +
  • +

    + named will now synthesize responses + from cached DNSSEC-verified records. This will reduce + query loads on authoritative servers for signed domains: + if existing cached records can be used to determine + the answer then no query needs to be sent. +

    +

    + This behavior is controlled by the new + named.conf option + synth-from-dnssec. It is enabled by + default. +

    +
    • diff --git a/doc/misc/options b/doc/misc/options index dfd5386680..7c29d94cb3 100644 --- a/doc/misc/options +++ b/doc/misc/options @@ -174,9 +174,9 @@ options { fetches-per-server [ ( drop | fail ) ]; fetches-per-zone [ ( drop | fail ) ]; files ( default | unlimited | ); - filter-aaaa { ; ... }; - filter-aaaa-on-v4 ( break-dnssec | ); - filter-aaaa-on-v6 ( break-dnssec | ); + filter-aaaa { ; ... }; // not configured + filter-aaaa-on-v4 ( break-dnssec | ); // not configured + filter-aaaa-on-v6 ( break-dnssec | ); // not configured flush-zones-on-shutdown ; forward ( first | only ); forwarders [ port ] [ dscp ] { ( @@ -188,8 +188,8 @@ options { fstrm-set-output-queue-model ( mpsc | spsc ); // not configured fstrm-set-output-queue-size ; // not configured fstrm-set-reopen-interval ; // not configured - geoip-directory ( | none ); - geoip-use-ecs ; + geoip-directory ( | none ); // not configured + geoip-use-ecs ; // not configured glue-cache ; has-old-clients ; // obsolete heartbeat-interval ; @@ -208,7 +208,7 @@ options { listen-on-v6 [ port ] [ dscp ] { ; ... }; // may occur multiple times - lmdb-mapsize ; + lmdb-mapsize ; // non-operational lock-file ( | none ); maintain-ixfr-base ; // obsolete managed-keys-directory ; @@ -516,9 +516,9 @@ view [ ] { fetch-quota-params ; fetches-per-server [ ( drop | fail ) ]; fetches-per-zone [ ( drop | fail ) ]; - filter-aaaa { ; ... }; - filter-aaaa-on-v4 ( break-dnssec | ); - filter-aaaa-on-v6 ( break-dnssec | ); + filter-aaaa { ; ... }; // not configured + filter-aaaa-on-v4 ( break-dnssec | ); // not configured + filter-aaaa-on-v6 ( break-dnssec | ); // not configured forward ( first | only ); forwarders [ port ] [ dscp ] { ( | ) [ port ] [ dscp ]; ... }; @@ -531,7 +531,7 @@ view [ ] { }; // may occur multiple times key-directory ; lame-ttl ; - lmdb-mapsize ; + lmdb-mapsize ; // non-operational maintain-ixfr-base ; // obsolete managed-keys {