From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peter =?utf-8?q?M=C3=BCller?= To: development@lists.ipfire.org Subject: [PATCH 3/3 v2] Unbound: Use aggressive NSEC Date: Mon, 27 Aug 2018 17:26:34 +0200 Message-ID: <1ba25917-a5f8-7a19-e62e-e850dc359bb3@link38.eu> In-Reply-To: <4c59f5c0-751f-c74c-1f3a-5a8dd27cfe9f@link38.eu> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============4794088002963237719==" List-Id: --===============4794088002963237719== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit This avoids some needless lookups to destination domains with a very high NXDOMAIN rate and reduces load on upstream servers. See https://nlnetlabs.nl/documentation/unbound/unbound.conf/ for further details. Signed-off-by: Peter Müller --- config/unbound/unbound.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/config/unbound/unbound.conf b/config/unbound/unbound.conf index 8b5d34ee3..8ad6bcb03 100644 --- a/config/unbound/unbound.conf +++ b/config/unbound/unbound.conf @@ -60,6 +60,7 @@ server: harden-referral-path: yes harden-algo-downgrade: no use-caps-for-id: yes + aggressive-nsec: yes # Harden against DNS cache poisoning unwanted-reply-threshold: 5000000 -- 2.16.4 --===============4794088002963237719== Content-Type: application/pgp-signature Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="signature.asc" MIME-Version: 1.0 LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KCmlRSXpCQUVCQ2dBZEZpRUV2UDRTaUdoRVlE SnlyUkxrMlVqeUQzMTduMmdGQWx1RUdDb0FDZ2tRMlVqeUQzMTcKbjJpYzFBLytKSEM4SVp3dWtN aG1XeENnZVdBRm5TMXVCcWpIc2RSQWRIQU9HZkQ4dllRdkdpcUZLOGRIQ0o3VQowUElPcW4xNWNT RFEraWZtYXhUYkNjdVI0YzJsNXJBenBQWkluWWpPdXJNckJTYXZkLzFIdm04c29YL0hCUjdWCitT ZGtOckFtYjRRMjh6dWRUUjFmVGYxS3doM0ZvNjNZb1kwUkZVdmxIU3Zxd1FPTU1UOEVTbW9rWU01 a2hCdFkKZW83ck5IYjkrbnp5ZEo1bzFCOXdoY3Q0K083L2hnZFNrdHN1Q2JuY1E4Q0JvYk94bEp0 THJIVnZqRnNicnZJaAp2cVlHUFNYOUs4aGhzV0dPUWNSRVFsN1RNbXh2b2orSmZqTy9YUlpGOXhl NmpHTmNQbzRiUlRkRFdiTmJBblFmCkNaY29MMEhzVXdkRkVHZSs1eW50Vkh2VGI3U1lpZkdaZDRy cE10Zlh1eEZEUDlMS1dKRWs1NEoxTlVUcU5NREcKOUhKK01NMDQyYkJwaXRCSE5kTDFJWjFvaHcz dld3OHV2dnZZRUFybGtaQVJWZytDR3RZUmp3U0t0dkxCUGszRQpkLytGWDY3T2YyOVNaNUFoQ3Ba RTlzaVlSeVNpZGJVTnkwOG5MUk9OR0ExWnpXbXV3VCtsa1VKWVNteElHcVQrCkcvMytFMS9GVzl6 Z0tDWDZZaFhRR1FOeng4MmVNS1lvYSt0TERyUjRKVU5ZaDd5ekFmdzJqeVhUcmxVNmxIbjQKRG5G ZmRsbGprQm4zaDB6UXJacDhvT0U2MXJFNlpNQVE5cFZGZjNmU2NtMk1UVkhqSnRpZUNqaGprSnJC WkhWagpNN2xwUThPbUtzUkFCSHhMckphU0s0dkpVcnVLK1U4ZUQvQklVSU9xb2daZkFlRlo0NVk9 Cj1zdU0xCi0tLS0tRU5EIFBHUCBTSUdOQVRVUkUtLS0tLQo= --===============4794088002963237719==--