portSend the query to a non-standard port on the server, - instead of the defaut port 53. This option would be used + instead of the default port 53. This option would be used to test a name server that has been configured to listen for queries on a non-standard port number.
dnssec-importkey — Import DNSKEY records from external systems so they can be managed.
+dnssec-importkey — import DNSKEY records from external systems so they can be managed
dnssec-revoke — Set the REVOKED bit on a DNSSEC key
+dnssec-revoke — set the REVOKED bit on a DNSSEC key
dnssec-settime — Set the key timing metadata for a DNSSEC key
+dnssec-settime — set the key timing metadata for a DNSSEC key
dnssec-checkds — A DNSSEC delegation consistency checking tool.
+dnssec-checkds — DNSSEC delegation consistency checking tool
named-rrchecker — A syntax checker for individual DNS resource records
+named-rrchecker — syntax checker for individual DNS resource records
As a slave zone can also be a master to other slaves, named, by default, sends NOTIFY messages for every zone it loads. Specifying notify master-only; will cause named to only send NOTIFY for master zones that it loads. -
None of the keys listed in this example are valid. In particular, the root key is not valid. -
When DNSSEC validation is enabled and properly configured,
the resolver will reject any answers from signed, secure zones
@@ -1614,12 +1618,14 @@ $ /opt/pkcs11/usr/bin/softhsm-util --init-token
The latest OpenSSL versions as of this writing (January 2015) are 0.9.8zc, 1.0.0o, and 1.0.1j. ISC will provide updated patches as new versions of OpenSSL are released. The version number in the following examples is expected to change. -
Before building BIND 9 with PKCS#11 support, it will be
necessary to build OpenSSL with the patch in place, and configure
@@ -1642,10 +1648,12 @@ $
+ The patch file may not be compatible with the
"patch" utility on all operating systems. You may need to
install GNU patch.
- patch -p1 -d openssl-0.9.8zc \
Note
- Note that the patch file may not be compatible with the
+
When building OpenSSL, place it in a non-standard location so that it does not interfere with OpenSSL libraries diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html index fadf671186..21b6a3652d 100644 --- a/doc/arm/Bv9ARM.ch06.html +++ b/doc/arm/Bv9ARM.ch06.html @@ -475,7 +475,7 @@ followed by '%' to represent percents.
- The behaviour is exactly the same as
+ The behavior is exactly the same as
size_spec, but
size_or_percent allows also
to specify a positive integer value followed by
@@ -3876,7 +3876,6 @@ options {
queries.
Caching may still occur as an effect the server's internal
operation, such as NOTIFY address lookups.
- See also fetch-glue above.
@@ -5242,13 +5241,15 @@ avoid-v6-udp-ports {};
If you do not wish the alternate transfer source to be used, you should set use-alt-transfer-source appropriately and you should not depend upon getting an answer back to the first refresh query. -
@@ -6334,7 +6335,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; may be sent while servicing a recursive query. If more queries are sent, the recursive query is terminated and returns SERVFAIL. Queries to - look up top level comains such as "com" and "net" + look up top level domains such as "com" and "net" and the DNS root zone are exempt from this limitation. The default is 75.
The real parent servers for these zones should disable all empty zone under the parent zone they serve. For the real root servers, this is all built-in empty zones. This will enable them to return referrals to deeper in the tree. -
@@ -7055,7 +7058,7 @@ deny-answer-aliases { "example.net"; };
A special form of local data is a CNAME whose target is a wildcard such as *.example.com. - It is used as if were an ordinary CNAME after the astrisk (*) + It is used as if were an ordinary CNAME after the asterisk (*) has been replaced with the query name. The purpose for this special form is query logging in the walled garden's authority DNS server. @@ -9198,7 +9201,7 @@ example.com. NS ns2.example.net. unsigned zone is transferred in or loaded from disk and a signed version of the zone is served, with possibly, a different serial number. This - behaviour is disabled by default. + behavior is disabled by default.
@@ -9413,7 +9416,7 @@ example.com. NS ns2.example.net.
The name field
is subject to DNS wildcard expansion, and
this rule matches when the name being updated
- name is a valid expansion of the wildcard.
+ is a valid expansion of the wildcard.
+ If the named daemon is running as an unprivileged user, it will not be able to bind to new restricted ports if the server is reloaded. -
An incorrect boundary check in the OPENPGPKEY rdatatype @@ -504,6 +504,9 @@
+ Updated the complied in addresses for H.ROOT-SERVERS.NET. +
ACLs containing geoip asnum elements were
not correctly matched unless the full organization name was
diff --git a/doc/arm/Bv9ARM.ch12.html b/doc/arm/Bv9ARM.ch12.html
index 29529edee8..86cc87436f 100644
--- a/doc/arm/Bv9ARM.ch12.html
+++ b/doc/arm/Bv9ARM.ch12.html
@@ -432,9 +432,13 @@ $ make
+ In practice, either -a or -r must be specified. Others can + be optional; the underlying library routine tries to identify the + appropriate server and the zone name for the update. +
+Examples: assuming the primary authoritative server of the dynamic.example.com zone has an IPv6 address 2001:db8::1234, diff --git a/doc/arm/Bv9ARM.ch13.html b/doc/arm/Bv9ARM.ch13.html index 0382467824..08894680a0 100644 --- a/doc/arm/Bv9ARM.ch13.html +++ b/doc/arm/Bv9ARM.ch13.html @@ -57,7 +57,7 @@ delv — DNS lookup and validation utility
portSend the query to a non-standard port on the server, - instead of the defaut port 53. This option would be used + instead of the default port 53. This option would be used to test a name server that has been configured to listen for queries on a non-standard port number.
dnssec-checkds — A DNSSEC delegation consistency checking tool.
+dnssec-checkds — DNSSEC delegation consistency checking tool
dnssec-importkey — Import DNSKEY records from external systems so they can be managed.
+dnssec-importkey — import DNSKEY records from external systems so they can be managed
dnssec-revoke — Set the REVOKED bit on a DNSSEC key
+dnssec-revoke — set the REVOKED bit on a DNSSEC key
dnssec-settime — Set the key timing metadata for a DNSSEC key
+dnssec-settime — set the key timing metadata for a DNSSEC key
named-rrchecker — A syntax checker for individual DNS resource records
+named-rrchecker — syntax checker for individual DNS resource records
An incorrect boundary check in the OPENPGPKEY rdatatype @@ -465,6 +465,9 @@
+ Updated the complied in addresses for H.ROOT-SERVERS.NET. +
ACLs containing geoip asnum elements were not correctly matched unless the full organization name was