- Added documentation for aggressive-nsec: yes.

git-svn-id: file:///svn/unbound/trunk@4575 be551aaa-1e26-0410-a405-d3ace91eadb9

diff --git a/doc/Changelog b/doc/Changelog
index 7a02715dd361c202de5924c0d0649059c3c2d2ae..905442ebe6faddffc0b752e9620571241d0509a7 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,6 @@
+12 March 2018: Wouter
+       - Added documentation for aggressive-nsec: yes.
+
 9 March 2018: Wouter
        - Fix #3598: Fix swig build issue on rhel6 based system.
          configure --disable-swig-version-check stops the swig version check.

diff --git a/doc/example.conf.in b/doc/example.conf.in
index e764b50f1764e30464966de32b17847350ae0164..dae86fb6fcb24bf82cda45d7afe4497e29663252 100644 (file)
--- a/doc/example.conf.in
+++ b/doc/example.conf.in
@@ -380,6 +380,10 @@ server:
        # This option only has effect when qname-minimisation is enabled.
        # qname-minimisation-strict: no
 
+       # Aggressive NSEC uses the DNSSEC NSEC chain to synthesize NXDOMAIN
+       # and other denials, using information from previous NXDOMAINs answers.
+       # aggressive-nsec: no
+
        # Use 0x20-encoded random bits in the query to foil spoof attempts.
        # This feature is an experimental implementation of draft dns-0x20.
        # use-caps-for-id: no

diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index 90a9a9fa8effc9ea4bda97560b4809ad519ab3d0..edde384ee3e75bc1b6540095bf0758fc3c299f02 100644 (file)
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -725,6 +725,12 @@ potentially broken nameservers. A lot of domains will not be resolvable when
 this option in enabled. Only use if you know what you are doing.
 This option only has effect when qname-minimisation is enabled. Default is off.
 .TP
+.B aggressive\-nsec: \fI<yes or no>
+Aggressive NSEC uses the DNSSEC NSEC chain to synthesize NXDOMAIN
+and other denials, using information from previous NXDOMAINs answers.
+Default is off.  It helps to reduce the query rate towards targets that get
+a very high nonexistant name lookup rate.
+.TP
 .B private\-address: \fI<IP address or subnet>
 Give IPv4 of IPv6 addresses or classless subnets. These are addresses
 on your private network, and are not allowed to be returned for