Rename compare-signatures-on-zone-freshness-check

(cherry picked from commit d804bbeb331f34187e9a61cfe4e989404c2e97c0)

diff --git a/docs/modes-of-operation.rst b/docs/modes-of-operation.rst
index 9a8a8d724777ad76f5e952ce40de2239cc57fc0e..3ba094f9b0d91ed24997afc3b50e82c0ca932f35 100644 (file)
--- a/docs/modes-of-operation.rst
+++ b/docs/modes-of-operation.rst
@@ -112,7 +112,7 @@ the primary server. In some conditions, some primary servers answer with
 a truncated SOA response (indicating TCP is required), and the freshness
 check will fail. As a workaround, the signature check and DO flag can be
 turned off by disabling
-:ref:`setting-compare-signatures-on-zone-freshness-check`.
+:ref:`setting-secondary-check-signature-freshness`.
 
 When the freshness of a domain cannot be checked, e.g. because the
 master is offline, PowerDNS will retry the domain after

diff --git a/docs/settings.rst b/docs/settings.rst
index c029582437af20b34dc7c5c3c9549ce96fc62ffe..6f94bbccffe9188a68d76b1f1a9f0ae281832adc 100644 (file)
--- a/docs/settings.rst
+++ b/docs/settings.rst
@@ -273,10 +273,10 @@ Either don't ``chroot`` on these systems or set the 'Type' of the
 service to 'simple' instead of 'notify' (refer to the systemd
 documentation on how to modify unit-files).
 
-.. _setting-compare-signatures-on-zone-freshness-check:
+.. _setting-secondary-check-signature-freshness:
 
-``compare-signatures-on-zone-freshness-check``
-----------------------------------------------
+``secondary-check-signature-freshness``
+---------------------------------------
 
 .. versionadded:: 4.7.0
 
@@ -284,13 +284,15 @@ documentation on how to modify unit-files).
 -  Default: yes
 
 Enabled by default, freshness checks for secondary zones will set the DO flag on SOA queries. PowerDNS
-uses the DNSSEC signatures in the SOA response to detect (signature) changes on the primary server, when
-the serial number was not increased.
+can detect (signature) changes on the primary server without serial number bumps using the DNSSEC
+signatures in the SOA response.
 
-In some scenarios, primary servers send truncated SOA responses. As a workaround, this setting can be
-turned off, and the DO flag as well as the signature checking will be disabled. To avoid additional
+In some problematic scenarios, primary servers send truncated SOA responses. As a workaround, this setting
+can be turned off, and the DO flag as well as the signature checking will be disabled. To avoid additional
 drift, primary servers then must always increase the zone serial on signature changes.
 
+It is strongly recommended to keep this setting enabled (`yes`).
+
 .. _setting-config-dir:
 
 ``config-dir``

diff --git a/pdns/auth-main.cc b/pdns/auth-main.cc
index 65bde150273cd4c6f6eabb2718f29fc987ad4ddb..b09faa61689fd83e0cc6ddd7776a9ab84814013d 100644 (file)
--- a/pdns/auth-main.cc
+++ b/pdns/auth-main.cc
@@ -214,7 +214,7 @@ void declareArguments()
   ::arg().set("allow-notify-from", "Allow AXFR NOTIFY from these IP ranges. If empty, drop all incoming notifies.") = "0.0.0.0/0,::/0";
   ::arg().set("slave-cycle-interval", "Schedule slave freshness checks once every .. seconds") = "60";
   ::arg().set("xfr-cycle-interval", "Schedule primary/secondary SOA freshness checks once every .. seconds") = "60";
-  ::arg().set("compare-signatures-on-zone-freshness-check", "Set DO flag on SOA queries to receive signatures for signature comparison") = "yes";
+  ::arg().set("secondary-check-signature-freshness", "Check signatures in SOA freshness check. Sets DO flag on SOA queries. Outside some very problematic scenarios, say yes here.") = "yes";
 
   ::arg().set("tcp-control-address", "If set, PowerDNS can be controlled over TCP on this address") = "";
   ::arg().set("tcp-control-port", "If set, PowerDNS can be controlled over TCP on this address") = "53000";

diff --git a/pdns/slavecommunicator.cc b/pdns/slavecommunicator.cc
index eaf4d22abdab5b3db780bd3d5e8cbd3a459e05cf..d71f3c0aba17203c76cc73a738a2a0fef4e4a40d 100644 (file)
--- a/pdns/slavecommunicator.cc
+++ b/pdns/slavecommunicator.cc
@@ -1182,7 +1182,7 @@ void CommunicatorClass::slaveRefresh(PacketHandler *P)
 
       DomainNotificationInfo dni;
       dni.di=di;
-      if (::arg().mustDo("compare-signatures-on-zone-freshness-check")) {
+      if (::arg().mustDo("secondary-check-signature-freshness")) {
         dni.dnssecOk = dk.doesDNSSEC();
       } else {
         dni.dnssecOk = false;
@@ -1331,7 +1331,7 @@ void CommunicatorClass::slaveRefresh(PacketHandler *P)
     }
     else if(hasSOA && theirserial == ourserial) {
       uint32_t maxExpire=0, maxInception=0;
-      if(dk.isPresigned(di.zone) && ::arg().mustDo("compare-signatures-on-zone-freshness-check")) {
+      if(dk.isPresigned(di.zone) && ::arg().mustDo("secondary-check-signature-freshness")) {
         B->lookup(QType(QType::RRSIG), di.zone, di.id); // can't use DK before we are done with this lookup!
         DNSZoneRecord zr;
         while(B->get(zr)) {