upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-02-21 08:50:32 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

regen master

Browse source
This commit is contained in:
Tinderbox User 2017-10-03 01:07:20 +00:00
parent c85b467dc0
commit 7cb14b610e
3 changed files with 38 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
doc/arm/Bv9ARM.ch06.html
View file

@ -4992,6 +4992,12 @@ options {
DNSSEC validation must be enabled for this
option to be effective.
</p>
<p>
This initial implementation only covers synthesis
of answers from NSEC records. Synthesis from NSEC3
is planned for the future. This will also be
controlled by <span class="command"><strong>synth-from-dnssec</strong></span>.
</p>
</li></ul></div>
<p>
</p>

23
doc/arm/Bv9ARM.ch09.html
View file

@ -214,13 +214,17 @@
</li>
<li class="listitem">
<p>
<span class="command"><strong>named</strong></span> can now synthesize NXDOMAIN responses
from cached DNSSEC-verified records returned in negative or
wildcard responses. This will reduce query loads on
authoritative servers for signed domains: if existing cached
records can be used by the resolver to determine that a name does
not exist in the authorittive domain, then no query needs to
be sent.
<span class="command"><strong>named</strong></span> can now synthesize negative responses
(NXDOMAIN, NODATA, or wildcard answers) from cached DNSSEC-verified
records that were returned in negative or wildcard responses from
authoritative servers.
</p>
<p>
This will reduce query loads on authoritative servers for signed
domains: when existing cached records can be used by the resolver
to determine that a name does not exist in the authorittive domain,
no query needs to be sent. Reducing the number of iterative queries
should also improve resolver performance.
</p>
<p>
This behavior is controlled by the new
@ -228,6 +232,11 @@
<span class="command"><strong>synth-from-dnssec</strong></span>. It is enabled by
default.
</p>
<p>
Note: this currently only works for zones signed using NSEC.
Support for zones signed using NSEC3 (without opt-out) is
planned for the future.
</p>
<p>
Thanks to APNIC for sponsoring this work.
</p>

23
doc/arm/notes.html
View file

@ -175,13 +175,17 @@
</li>
<li class="listitem">
<p>
<span class="command"><strong>named</strong></span> can now synthesize NXDOMAIN responses
from cached DNSSEC-verified records returned in negative or
wildcard responses. This will reduce query loads on
authoritative servers for signed domains: if existing cached
records can be used by the resolver to determine that a name does
not exist in the authorittive domain, then no query needs to
be sent.
<span class="command"><strong>named</strong></span> can now synthesize negative responses
(NXDOMAIN, NODATA, or wildcard answers) from cached DNSSEC-verified
records that were returned in negative or wildcard responses from
authoritative servers.
</p>
<p>
This will reduce query loads on authoritative servers for signed
domains: when existing cached records can be used by the resolver
to determine that a name does not exist in the authorittive domain,
no query needs to be sent. Reducing the number of iterative queries
should also improve resolver performance.
</p>
<p>
This behavior is controlled by the new
@ -189,6 +193,11 @@
<span class="command"><strong>synth-from-dnssec</strong></span>. It is enabled by
default.
</p>
<p>
Note: this currently only works for zones signed using NSEC.
Support for zones signed using NSEC3 (without opt-out) is
planned for the future.
</p>
<p>
Thanks to APNIC for sponsoring this work.
</p>