Skip to content

Instantly share code, notes, and snippets.

@hdais

hdais/nta-for-bind910.conf

Created February 18, 2016 17:53
Show Gist options
  • Save hdais/3e9681fdeecfbea19ebe to your computer and use it in GitHub Desktop.
Save hdais/3e9681fdeecfbea19ebe to your computer and use it in GitHub Desktop.
Download ZIP
Negative Trust Anchor for BIND 9.10
Raw
nta-for-bind910.conf
options {
// Enable DNSSEC validation
dnssec-validation auto;
// set NTA to dnssec-failed.org
// BIND9.10 and higher implements disable-ds-digests
disable-ds-digests dnssec-failed.org { SHA-1; SHA-256; };
};
@jplitza
Copy link

jplitza commented Mar 21, 2018

This didn't work for insecure TLDs for me:

dnssec:   validating tld/SOA: got insecure response; parent indicates it should be secure

So yes, this disables the DNSSEC validation for that domain, but if the parent mandates it to be secure, this doesn't help.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment