From: Mark Karpilovskij Date: Thu, 11 Oct 2018 01:12:36 +0000 (+0200) Subject: doc: a couple of DNSSEC notes for the GeoIP module X-Git-Tag: v2.8.0~218 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9c2bbbfdd710fc2ab76cd4f669e8d9335afd1890;p=thirdparty%2Fknot-dns.git doc: a couple of DNSSEC notes for the GeoIP module --- diff --git a/src/knot/modules/geoip/geoip.rst b/src/knot/modules/geoip/geoip.rst index 3309d5753b..8c9dddfdec 100644 --- a/src/knot/modules/geoip/geoip.rst +++ b/src/knot/modules/geoip/geoip.rst @@ -25,10 +25,18 @@ have a **default** RRset of the same type contained in the zone, so that the NSE chain can be built correctly. Also, it is STRONGLY RECOMMENDED to use manual key rollover in this setting, as the module has to be reloaded when the signing key changes. +.. NOTE:: + If the GeoIP module is used with automatic DNSSEC signing, the keys for computing record signatures + MUST exist or be generated before the server is launched, otherwise the module fails to + compute the signatures and does not load. + Alternatively, the :ref:`geoip` module may be combined with the :ref:`onlinesign` module and the tailored responses can be signed -on the fly. This approach is more computationally demanding for the server. +on the fly. This approach is much more computationally demanding for the server. +.. NOTE:: + If the GeoIP module is used with online signing, it is recommended to set the :ref:`nsec-bitmap` + option of the onlinesign module to contain all Resource Record types potentially generated by the module. Example -------