Matthijs Mekking ff4201e388 Lower the maximum allowed NSEC3 iterations to 50 ... BIND 9 will now treat the response as insecure when processing NSEC3 records with iterations larger than 50. Earlier, we limited the number of iterations to 150 (in #2445). RFC 9276 says: Because there has been a large growth of open (public) DNSSEC validating resolvers that are subject to compute resource constraints when handling requests from anonymous clients, this document recommends that validating resolvers reduce their iteration count limits over time. Specifically, validating resolver operators and validating resolver software implementers are encouraged to continue evaluating NSEC3 iteration count deployment trends and lower their acceptable iteration limits over time. After evaluation, we decided that the next major BIND release should lower the maximum allowed NSEC3 iterations to 50, which should be fine for 99,87% of the domain names.		2023-12-05 14:58:58 +00:00
..
dns	Lower the maximum allowed NSEC3 iterations to 50	2023-12-05 14:58:58 +00:00
dst	Refactor KSK processing	2023-07-20 12:40:52 +02:00
irs	Move irs_resconf into libdns and remove libirs	2023-02-24 09:38:59 +00:00
.clang-format	Add separate .clang-format files for headers	2020-02-14 09:31:05 +01:00