document default-publish-{cdnskey,cds}

diff --git a/docs/domainmetadata.rst b/docs/domainmetadata.rst
index 172cb2d07bede7e1eb15a3de69b8ace8b0158785..9b3f59e0ba4639a97d421ecfe86474d168010868 100644 (file)
--- a/docs/domainmetadata.rst
+++ b/docs/domainmetadata.rst
@@ -167,6 +167,8 @@ Also see ``set-presigned`` in :doc:`pdnsutil <dnssec/pdnsutil>`.
 If a zone is presigned, the content of the metadata must be "1" (without
 the quotes). Any other value will not signal presignedness.
 
+.. _metadata-publish-cdnskey-publish-cds:
+
 PUBLISH-CDNSKEY, PUBLISH-CDS
 ----------------------------
 
@@ -184,6 +186,8 @@ This metadata can also be set using the
 and ``set-publish-cds``. For an example for an :rfc:`7344` key rollover,
 see the :doc:`guides/kskrollcdnskey`.
 
+Global defaults for these values can be set via :ref:`setting-default-publish-cdnskey` and :ref:`setting-default-publish-cds`.
+
 .. _metadata-slave-renotify:
 
 SLAVE-RENOTIFY

diff --git a/docs/settings.rst b/docs/settings.rst
index a5d7b2b9c4dbbc34e39714be516e57a08f964d0d..f7fd1260bf645641f202fd1a1514d6c35c0e2da6 100644 (file)
--- a/docs/settings.rst
+++ b/docs/settings.rst
@@ -373,6 +373,31 @@ to enable DNSSEC. Must be one of:
 The default keysize for the KSK generated with :doc:`pdnsutil secure-zone <dnssec/pdnsutil>`.
 Only relevant for algorithms with non-fixed keysizes (like RSA).
 
+.. _setting-default-publish-cdnskey:
+
+``default-publish-cdnskey``
+---------------------------
+- Integer
+- Default: empty
+
+.. versionadded:: 4.3.0
+
+The default PUBLISH-CDNSKEY value for zones that do not have one individually specified.
+See the :ref:`metadata-publish-cdnskey-publish-cds` docs for more information.
+
+.. _setting-default-publish-cds:
+
+``default-publish-cds``
+-----------------------
+
+- Comma-separated integers
+- Default: empty
+
+.. versionadded:: 4.3.0
+
+The default PUBLISH-CDS value for zones that do not have one individually specified.
+See the :ref:`metadata-publish-cdnskey-publish-cds` docs for more information.
+
 .. _setting-default-soa-edit:
 
 ``default-soa-edit``