You need to have the following programs installed and in your PATH.
* dig - from the bind-tools package. Used to send DNS queries.
+* wdiff - used for word-by-word comparisons.
* splint (optional) - for lint test
* doxygen (optional) - for doc completeness test
* ldns-testns (optional) - from ldns examples. Used as DNS auth server.
# val-bogus-ttl: 60
# The signature inception and expiration dates are allowed to be off
- # by 10% of the lifetime of the signature from our local clock.
+ # by 10% of the signature lifetime (expir-incep) from our local clock.
# This leeway is capped with a minimum and a maximum. In seconds.
# val-sig-skew-min: 3600
# val-sig-skew-max: 86400
.TP
.B val\-sig\-skew\-min: \fI<seconds>
Minimum number of seconds of clock skew to apply to validated signatures.
-A value of 10% of the signature lifetime is used, capped by this setting.
-Default is 3600 (1 hour) which allows for daylight savings differences.
-Lower this value for more strict checking of short lived signatures.
+A value of 10% of the signature lifetime (expiration \- inception) is
+used, capped by this setting. Default is 3600 (1 hour) which allows for
+daylight savings differences. Lower this value for more strict checking
+of short lived signatures.
.TP
.B val\-sig\-skew\-max: \fI<seconds>
Maximum number of seconds of clock skew to apply to validated signatures.
-A value of 10% of the signature lifetime is used, capped by this setting.
-Default is 86400 (24 hours) which allows for timezone setting problems in
-stable domains. Setting both min and max very low disables the clock skew
-allowances. Setting both min and max very high makes the validator check
-the signature timestamps less strictly.
+A value of 10% of the signature lifetime (expiration \- inception)
+is used, capped by this setting. Default is 86400 (24 hours) which
+allows for timezone setting problems in stable domains. Setting both
+min and max very low disables the clock skew allowances. Setting both
+min and max very high makes the validator check the signature timestamps
+less strictly.
.TP
.B val\-bogus\-ttl: \fI<number>
The time to live for bogus data. This is data that has failed validation;