Unbound: Use aggressive NSEC

This avoids some needless lookups to destination domains
with a very high NXDOMAIN rate and reduces load on upstream
servers.

See https://nlnetlabs.nl/documentation/unbound/unbound.conf/
for further details.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/config/unbound/unbound.conf b/config/unbound/unbound.conf
index 6eaf70a8eaef8082e9a92a4cbf9c6b2d578d2715..cda591dab4dd862f00f06aa010486ac2f0c181d0 100644 (file)
--- a/config/unbound/unbound.conf
+++ b/config/unbound/unbound.conf
@@ -60,6 +60,7 @@ server:
        harden-referral-path: yes
        harden-algo-downgrade: no
        use-caps-for-id: yes
+       aggressive-nsec: yes
 
        # Harden against DNS cache poisoning
        unwanted-reply-threshold: 1000000