+27 August 2018: Wouter
+ - Set defaults to yes for a number of options to increase speed and
+ resilience of the server. The so-reuseport, harden-below-nxdomain,
+ and minimal-responses options are enabled by default. They used
+ to be disabled by default, waiting to make sure they worked. They
+ are enabled by default now, and can be disabled explicitly by
+ setting them to "no" in the unbound.conf config file. The reuseport
+ and minimal options increases speed of the server, and should be
+ otherwise harmless. The harden-below-nxdomain option works well
+ together with the recently default enabled qname minimisation, this
+ causes more fetches to use information from the cache.
+
22 August 2018: George
- #4140: Expose repinfo (comm_reply) to the inplace_callbacks. This
gives access to reply information for the client's communication
# so-sndbuf: 0
# use SO_REUSEPORT to distribute queries over threads.
- # so-reuseport: no
+ # so-reuseport: yes
# use IP_TRANSPARENT so the interface: addresses can be non-local
# and you can config non-existing IPs that are going to work later on
# harden-dnssec-stripped: yes
# Harden against queries that fall under dnssec-signed nxdomain names.
- # harden-below-nxdomain: no
+ # harden-below-nxdomain: yes
# Harden the referral path by performing additional queries for
# infrastructure data. Validates the replies (if possible).
# if yes, Unbound doesn't insert authority/additional sections
# into response messages when those sections are not required.
- # minimal-responses: no
+ # minimal-responses: yes
# true to disable DNSSEC lameness check in iterator.
# disable-dnssec-lame-check: no
.B so\-reuseport: \fI<yes or no>
If yes, then open dedicated listening sockets for incoming queries for each
thread and try to set the SO_REUSEPORT socket option on each socket. May
-distribute incoming queries to threads more evenly. Default is no. On Linux
-it is supported in kernels >= 3.9. On other systems, FreeBSD, OSX it may
-also work. You can enable it (on any platform and kernel),
+distribute incoming queries to threads more evenly. Default is yes.
+On Linux it is supported in kernels >= 3.9. On other systems, FreeBSD, OSX
+it may also work. You can enable it (on any platform and kernel),
it then attempts to open the port and passes the option if it was available
at compile time, if that works it is used, if it fails, it continues
silently (unless verbosity 3) without the option.
might return nxdomain for empty nonterminals (that usually happen for reverse
IP address lookups), and thus may be incompatible with this. To try to avoid
this only DNSSEC-secure nxdomains are used, because the old software does not
-have DNSSEC. Default is off.
+have DNSSEC. Default is on.
The nxdomain must be secure, this means nsec3 with optout is insufficient.
.TP
.B harden\-referral\-path: \fI<yes or no>
If yes, Unbound doesn't insert authority/additional sections into response
messages when those sections are not required. This reduces response
size significantly, and may avoid TCP fallback for some responses.
-This may cause a slight speedup. The default is no, because the DNS
+This may cause a slight speedup. The default is yes, even though the DNS
protocol RFCs mandate these sections, and the additional content could
-be of use and save roundtrips for clients.
+be of use and save roundtrips for clients. Because they are not used,
+and the saved roundtrips are easier saved with prefetch, whilst this is
+faster.
.TP
.B disable-dnssec-lame-check: \fI<yes or no>
If true, disables the DNSSEC lameness check in the iterator. This check
log-time-ascii: yes
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
log-time-ascii: yes
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
log-time-ascii: yes
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
log-time-ascii: yes
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
val-override-date: "20070916134226"
target-fetch-policy: "0 0 0 0 0"
fake-sha1: yes
+ minimal-responses: no
stub-zone:
name: "."
val-override-date: "20070916134226"
target-fetch-policy: "0 0 0 0 0"
fake-sha1: yes
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
target-fetch-policy: "0 0 0 0 0"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
module-config: "dns64 validator iterator"
dns64-prefix: 64:ff9b::0/96
+ minimal-responses: no
stub-zone:
name: "."
domain-insecure: "example.net"
val-override-date: "20070916134226"
target-fetch-policy: "0 0 0 0 0"
+ minimal-responses: no
stub-zone:
name: "."
server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
+ minimal-responses: no
stub-zone:
name: "."
server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
+ minimal-responses: no
stub-zone:
name: "."
; This is a comment.
; config options go here.
+server:
+ minimal-responses: no
forward-zone: name: "." forward-addr: 216.0.0.1
CONFIG_END
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
harden-glue: "no"
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
+ minimal-responses: no
stub-zone:
name: "."
harden-referral-path: no
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
+ minimal-responses: no
stub-zone:
name: "."
; config options
server:
target-fetch-policy: "0 0 0 0 0"
+ minimal-responses: no
stub-zone:
name: "."
; config options
server:
target-fetch-policy: "0 0 0 0 0"
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
; config options
server:
target-fetch-policy: "0 0 0 0 0"
+ minimal-responses: no
stub-zone:
name: "."
; config options
server:
target-fetch-policy: "0 0 0 0 0"
+ minimal-responses: no
stub-zone:
name: "."
; config options
server:
target-fetch-policy: "0 0 0 0 0"
+ minimal-responses: no
stub-zone:
name: "."
; config options
server:
target-fetch-policy: "0 0 0 0 0"
+ minimal-responses: no
stub-zone:
name: "."
do-ip6: no
target-fetch-policy: "0 0 0 0 0 "
qname-minimisation: "no"
+ minimal-responses: no
stub-zone:
name: "."
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
+ minimal-responses: no
stub-zone:
name: "."
harden-referral-path: no
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
+ minimal-responses: no
stub-zone:
name: "."
; config options
server:
target-fetch-policy: "0 0 0 0 0"
+ minimal-responses: no
stub-zone:
name: "."
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
module-config: "iterator"
+ minimal-responses: no
stub-zone:
name: "."
server:
target-fetch-policy: "3 2 1 0 0"
qname-minimisation: "no"
+ minimal-responses: no
stub-zone:
name: "."
harden-referral-path: yes
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
+ minimal-responses: no
stub-zone:
name: "."
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
; config options
server:
target-fetch-policy: "0 0 0 0 0"
+ minimal-responses: no
stub-zone:
name: "."
; config options
server:
target-fetch-policy: "0 0 0 0 0"
+ minimal-responses: no
stub-zone:
name: "."
; config options
server:
target-fetch-policy: "0 0 0 0 0"
+ minimal-responses: no
stub-zone:
name: "."
server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
+ minimal-responses: no
stub-zone:
name: "."
; config options
server:
target-fetch-policy: "0 0 0 0 0"
+ minimal-responses: no
stub-zone:
name: "."
; config options
server:
target-fetch-policy: "0 0 0 0 0"
+ minimal-responses: no
stub-zone:
name: "."
; config options
server:
target-fetch-policy: "0 0 0 0 0"
+ minimal-responses: no
stub-zone:
name: "."
; config options
server:
target-fetch-policy: "0 0 0 0 0"
+ minimal-responses: no
stub-zone:
name: "."
server:
target-fetch-policy: "0 0 0 0 0"
do-ip6: no
+ minimal-responses: no
stub-zone:
name: "."
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
prefetch: "yes"
+ minimal-responses: no
stub-zone:
name: "."
server:
target-fetch-policy: "0 0 0 0 0"
prefetch: "yes"
+ minimal-responses: no
stub-zone:
name: "."
server:
target-fetch-policy: "0 0 0 0 0"
prefetch: "yes"
+ minimal-responses: no
stub-zone:
name: "."
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
prefetch: "yes"
+ minimal-responses: no
stub-zone:
name: "."
server:
target-fetch-policy: "0 0 0 0 0"
prefetch: "yes"
+ minimal-responses: no
stub-zone:
name: "."
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
prefetch: "yes"
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
+ minimal-responses: no
private-address: 10.0.0.0/8
private-address: 172.16.0.0/12
; config options
server:
target-fetch-policy: "0 0 0 0 0"
+ minimal-responses: no
stub-zone:
name: "."
server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
+ minimal-responses: no
stub-zone:
name: "."
; config options
server:
target-fetch-policy: "0 0 0 0 0"
+ minimal-responses: no
stub-zone:
name: "."
server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
+ minimal-responses: no
stub-zone:
name: "."
server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
+ minimal-responses: no
stub-zone:
name: "."
; config options
server:
target-fetch-policy: "0 0 0 0 0"
+ minimal-responses: no
stub-zone:
name: "."
server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: yes
+ minimal-responses: no
stub-zone:
name: "."
server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: yes
+ minimal-responses: no
stub-zone:
name: "."
server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: yes
+ minimal-responses: no
stub-zone:
name: "."
harden-referral-path: no
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
+ minimal-responses: no
stub-zone:
name: "."
harden-referral-path: no
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
; config options
server:
target-fetch-policy: "0 0 0 0 0"
+ minimal-responses: no
stub-zone:
name: "."
; config options
server:
target-fetch-policy: "0 0 0 0 0"
+ minimal-responses: no
stub-zone:
name: "."
; config options
server:
target-fetch-policy: "0 0 0 0 0"
+ minimal-responses: no
stub-zone:
name: "."
; config options
server:
target-fetch-policy: "0 0 0 0 0"
+ minimal-responses: no
stub-zone:
name: "."
server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
+ minimal-responses: no
stub-zone:
name: "."
; This is a comment.
; config options go here.
+server:
+ minimal-responses: no
forward-zone: name: "." forward-addr: 216.0.0.1
CONFIG_END
; This is a comment.
; config options go here.
+server:
+ minimal-responses: no
forward-zone: name: "." forward-addr: 216.0.0.1
CONFIG_END
; This is a comment.
; config options go here.
+server:
+ minimal-responses: no
forward-zone: name: "." forward-addr: 216.0.0.1
CONFIG_END
; config options
server:
target-fetch-policy: "0 0 0 0 0"
+ minimal-responses: no
stub-zone:
name: "."
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
access-control: 127.0.0.1 allow_snoop
cache-max-ttl: 10
qname-minimisation: "no"
+ minimal-responses: no
stub-zone:
name: "."
access-control: 127.0.0.1 allow_snoop
cache-min-ttl: 10
qname-minimisation: "no"
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
fake-sha1: yes
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
target-fetch-policy: "0 0 0 0 0"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
prefetch: yes
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
fake-sha1: yes
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
fake-sha1: yes
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
dlv-anchor: "dlv.isc.org. IN DNSKEY 257 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
harden-algo-downgrade: no
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
harden-algo-downgrade: no
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
val-override-date: "20091116100204"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
forward-zone:
name: "."
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
fake-sha1: yes
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
qname-minimisation: "no"
fake-sha1: yes
trust-anchor-signaling: no
+ minimal-responses: no
stub-zone:
name: "."
server:
target-fetch-policy: "0 0 0 0 0"
qname-minimisation: "no"
+ minimal-responses: no
access-control: 10.10.10.0/24 allow
access-control-view: 10.10.10.10/32 "view1"
cfg->if_automatic = 0;
cfg->so_rcvbuf = 0;
cfg->so_sndbuf = 0;
- cfg->so_reuseport = 0;
+ cfg->so_reuseport = 1;
cfg->ip_transparent = 0;
cfg->ip_freebind = 0;
cfg->num_ifs = 0;
cfg->harden_large_queries = 0;
cfg->harden_glue = 1;
cfg->harden_dnssec_stripped = 1;
- cfg->harden_below_nxdomain = 0;
+ cfg->harden_below_nxdomain = 1;
cfg->harden_referral_path = 0;
cfg->harden_algo_downgrade = 0;
cfg->use_caps_bits_for_id = 0;
cfg->control_ifs.last = NULL;
cfg->control_port = UNBOUND_CONTROL_PORT;
cfg->control_use_cert = 1;
- cfg->minimal_responses = 0;
+ cfg->minimal_responses = 1;
cfg->rrset_roundrobin = 0;
cfg->max_udp_size = 4096;
if(!(cfg->server_key_file = strdup(RUN_DIR"/unbound_server.key")))
forward nameserver running on localhost */
cfg->val_log_level = 2; /* to fill why_bogus with */
cfg->val_log_squelch = 1;
+ cfg->minimal_responses = 0;
return cfg;
}
projects / thirdparty / unbound.git / commitdiff
