Warning

Options in this section are intended only for expert users and normally should not be needed.

Since version 4.0, DNSSEC validation is enabled by default. If you really need to turn DNSSEC off and are okay with lowering security of your system by doing so, add the following snippet to your configuration file.

# turns off DNSSEC validation
dnssec: false

The resolver supports DNSSEC including RFC 5011 automated DNSSEC TA updates and RFC 7646 negative trust anchors. Depending on your distribution, DNSSEC trust anchors should be either maintained in accordance with the distro-wide policy, or automatically maintained by the resolver itself.

In practice this means that you can forget about it and your favorite Linux distribution will take care of it for you.

Following dnssec section allow to modify DNSSEC configuration if you really have to:

dnssec: false|<options>

DNSSEC configuration options. If false, DNSSEC is disabled.

trust-anchors-files: <list>
file: <path>

Path to the key file.

read-only: true|false
Default:

false

Blocks zonefile updates according to RFC 5011.

The format is standard zone file, though additional information may be persisted in comments. Either DS or DNSKEY records can be used for TAs. If the file does not exist, bootstrapping of root TA will be attempted. If you want to use bootstrapping, install lua-http library.

Each file can only contain records for a single domain. The TAs will be updated according to RFC 5011 and persisted in the file (if allowed).

dnssec:
  trust-anchors-files:
    - file: root.key
      read-only: false
hold-down-time: <time ms|s|m|h|d>
Default:

30d (30 days)

Modify RFC 5011 hold-down timer to given value. Intended only for testing purposes.

refresh-time: <time ms|s|m|h|d>

Modify RFC5011 refresh timer to given value (not set by default), this will force trust anchors to be updated every N seconds periodically instead of relying on RFC5011 logic and TTLs. Intended only for testing purposes.

keep-removed: <int>
Default:

0

How many Removed keys should be held in history (and key file) before being purged. Note: all Removed keys will be purged from key file after restarting the process.

negative-trust-anchors: <list of domain names>

When you use a domain name as an negative trust anchor (NTA), DNSSEC validation will be turned off at/below these names. If you want to disable DNSSEC validation completely, set dnssec: false instead.

dnssec:
  negative-trust-anchors:
    - bad.boy
    - example.com

Warning

If you set NTA on a name that is not a zone cut, it may not always affect names not separated from the NTA by a zone cut.

trust-anchors: <list of RR strings>

Inserts DS/DNSKEY record(s) in presentation format (e.g. . 3600 IN DS 19036 8 2 49AAC11...) into current keyset. These will not be managed or updated, use it only for testing or if you have a specific use case for not using a keyfile.

Note

Static keys are very error-prone and should not be used in production. Use trust-anchors-files instead.

dnssec:
  trust-anchors:
    - ". 3600 IN DS 19036 8 2 49AAC11..."