- Fix #425: Document auth-zone supports communication with DNS primary

  on nondefault port.

diff --git a/doc/Changelog b/doc/Changelog
index 2211086a7ce92b0e275f21aa158a9fa546dbee0f..ab75add773649d58601c426ec2a5d10d48f94e76 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,6 +1,8 @@
 7 June 2021: George
        - Merge #448 from shoeper: Update unbound-control.8.in, fix
          rpz_disable typo.
+       - Fix #425: Document auth-zone supports communication with DNS
+         primary on nondefault port.
 
 1 June 2021: George
        - Fix test for zonemd-check option.

diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index b0ed3aa262715ec58836515c69ad4194a0fc3f12..f3cca17a915457acfea4589a45afb2d9b3332c76 100644 (file)
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -1923,7 +1923,9 @@ Name of the authority zone.
 .B primary: \fI<IP address or host name>
 Where to download a copy of the zone from, with AXFR and IXFR.  Multiple
 primaries can be specified.  They are all tried if one fails.
-With the "ip#name" notation a AXFR over TLS can be used.
+To use a nondefault port for DNS communication append '@' with the port number.
+You can append a '#' and a name, then AXFR over TLS can be used and the tls authentication certificates will be checked with that name.  If you combine
+the '@' and '#', the '@' comes first.
 If you point it at another Unbound instance, it would not work because
 that does not support AXFR/IXFR for the zone, but if you used \fBurl:\fR to download
 the zonefile as a text file from a webserver that would work.
@@ -2500,6 +2502,15 @@ Name of the authority zone.
 .B primary: \fI<IP address or host name>
 Where to download a copy of the zone from, with AXFR and IXFR.  Multiple
 primaries can be specified.  They are all tried if one fails.
+To use a nondefault port for DNS communication append '@' with the port number.
+You can append a '#' and a name, then AXFR over TLS can be used and the tls authentication certificates will be checked with that name.  If you combine
+the '@' and '#', the '@' comes first.
+If you point it at another Unbound instance, it would not work because
+that does not support AXFR/IXFR for the zone, but if you used \fBurl:\fR to download
+the zonefile as a text file from a webserver that would work.
+If you specify the hostname, you cannot use the domain from the zonefile,
+because it may not have that when retrieving that data, instead use a plain
+IP address to avoid a circular dependency on retrieving that IP address.
 .TP
 .B master: \fI<IP address or host name>
 Alternate syntax for \fBprimary\fR.