From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peter =?utf-8?q?M=C3=BCller?= To: development@lists.ipfire.org Subject: [PATCH v4 3/3] Unbound: Use aggressive NSEC Date: Mon, 10 Sep 2018 16:21:26 +0200 Message-ID: <20180910142126.5265-3-peter.mueller@link38.eu> In-Reply-To: <20180910142126.5265-1-peter.mueller@link38.eu> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============3476260783678355889==" List-Id: --===============3476260783678355889== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit This avoids some needless lookups to destination domains with a very high NXDOMAIN rate and reduces load on upstream servers. See https://nlnetlabs.nl/documentation/unbound/unbound.conf/ for further details. Signed-off-by: Peter Müller --- config/unbound/unbound.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/config/unbound/unbound.conf b/config/unbound/unbound.conf index 6eaf70a8e..cda591dab 100644 --- a/config/unbound/unbound.conf +++ b/config/unbound/unbound.conf @@ -60,6 +60,7 @@ server: harden-referral-path: yes harden-algo-downgrade: no use-caps-for-id: yes + aggressive-nsec: yes # Harden against DNS cache poisoning unwanted-reply-threshold: 1000000 -- 2.16.4 --===============3476260783678355889==--