From: Evil Eye <malusluminis@hotmail.com>
Date: Wed, 7 Feb 2024 09:48:12 +0000 (+0000)
Subject: Add documentation
X-Git-Tag: rec-5.1.0-alpha1~88^2~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c3d34b43ebc590c67d52205af47620c7a29d4b94;p=thirdparty%2Fpdns.git

Add documentation
---

diff --git a/docs/dnsupdate.rst b/docs/dnsupdate.rst
index f1f946fa68..d6e0f72efb 100644
--- a/docs/dnsupdate.rst
+++ b/docs/dnsupdate.rst
@@ -46,6 +46,13 @@ combination with the ``ALLOW-DNSUPDATE-FROM`` :doc:`domain metadata <domainmetad
 zone. Setting a range here and in ``ALLOW-DNSUPDATE-FROM`` enables updates
 from either address range.
 
+``dnsupdate-require-tsig``
+~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+A setting to require DNS updates to be signed by a valid TSIG signature.
+The default is no, which means zones without TSIG keys can be updated by
+unauthenticated agents operating from an allowed address range.
+
 ``forward-dnsupdate``
 ~~~~~~~~~~~~~~~~~~~~~
 
@@ -152,6 +159,7 @@ both requirements need to be satisfied before an update will be accepted.
 By default, an update can add, update or delete any resource records in
 the zone.  See :ref:`dnsupdate-update-policy` for finer-grained
 control of what an update is allowed to do.
+Use :ref:`setting-dnsupdate-require-tsig` to disallow unsigned updates.
 
 .. _metadata-forward-dnsupdate:
 
diff --git a/docs/settings.rst b/docs/settings.rst
index 4d191681e6..66cfa9754e 100644
--- a/docs/settings.rst
+++ b/docs/settings.rst
@@ -654,6 +654,16 @@ caching.
 
 Enable/Disable DNS update (RFC2136) support. See :doc:`dnsupdate` for more.
 
+.. _setting-dnsupdate-require-tsig:
+
+``dnsupdate-require-tsig``
+-------------
+
+-  Boolean
+-  Default: no
+
+Requires DNS updates to be signed by a valid TSIG signature even if the zone has no associated keys.
+
 .. _setting-do-ipv6-additional-processing:
 
 ``do-ipv6-additional-processing``