Change default of dnssec-dnskey-kskonly to yes

The extra RRSIG on DNSKEY, CDS and CDNSKEY RRsets add to the payload,
without having added value.

diff --git a/bin/named/config.c b/bin/named/config.c
index 0a54bb2ec7099e40dc46b94df79ea10149a50447..f57f0fe2ed040419b13dadbad357fd52b23a97bd 100644 (file)
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -222,7 +222,7 @@ options {\n\
        check-srv-cname warn;\n\
        check-wildcard yes;\n\
        dialup no;\n\
-       dnssec-dnskey-kskonly no;\n\
+       dnssec-dnskey-kskonly yes;\n\
        dnssec-loadkeys-interval 60;\n\
        dnssec-secure-to-insecure no;\n\
        dnssec-update-mode maintain;\n\

diff --git a/bin/tests/system/autosign/ns1/named.conf.in b/bin/tests/system/autosign/ns1/named.conf.in
index 0c3a4bf6b83152063465c071d8828e57f0b2afdd..93b22a116a95cf19b7f985c194cb0682ecef8085 100644 (file)
--- a/bin/tests/system/autosign/ns1/named.conf.in
+++ b/bin/tests/system/autosign/ns1/named.conf.in
@@ -40,6 +40,7 @@ zone "." {
        allow-query { any; };
        allow-update { any; };
        auto-dnssec maintain;
+       dnssec-dnskey-kskonly no;
 };
 
 include "trusted.conf";

diff --git a/bin/tests/system/autosign/ns3/named.conf.in b/bin/tests/system/autosign/ns3/named.conf.in
index 7c8f74f19a2164a1a856653640711bc4a2ede526..7751cc2e425d7dc5f98e270b1c7137f34d36b267 100644 (file)
--- a/bin/tests/system/autosign/ns3/named.conf.in
+++ b/bin/tests/system/autosign/ns3/named.conf.in
@@ -253,6 +253,7 @@ zone "sync.example" {
        type primary;
        file "sync.example.db";
        allow-update { any; };
+       dnssec-dnskey-kskonly no;
        auto-dnssec maintain;
 };
 

diff --git a/bin/tests/system/dnssec/ns2/named.conf.in b/bin/tests/system/dnssec/ns2/named.conf.in
index 3928ec03adb0215d0f9391013c925b48103acdff..ebfd69d69a6be56527e43b33299b9132e877a8ea 100644 (file)
--- a/bin/tests/system/dnssec/ns2/named.conf.in
+++ b/bin/tests/system/dnssec/ns2/named.conf.in
@@ -117,6 +117,7 @@ zone "cds-x.secure" {
 
 zone "cds-update.secure" {
        type primary;
+       dnssec-dnskey-kskonly no;
        file "cds-update.secure.db.signed";
        allow-update { any; };
 };
@@ -130,6 +131,7 @@ zone "cds-kskonly.secure" {
 
 zone "cds-auto.secure" {
        type primary;
+       dnssec-dnskey-kskonly no;
        file "cds-auto.secure.db.signed";
        auto-dnssec maintain;
        allow-update { any; };
@@ -147,6 +149,7 @@ zone "cdnskey-x.secure" {
 
 zone "cdnskey-update.secure" {
        type primary;
+       dnssec-dnskey-kskonly no;
        file "cdnskey-update.secure.db.signed";
        allow-update { any; };
 };
@@ -160,6 +163,7 @@ zone "cdnskey-kskonly.secure" {
 
 zone "cdnskey-auto.secure" {
        type primary;
+       dnssec-dnskey-kskonly no;
        file "cdnskey-auto.secure.db.signed";
        auto-dnssec maintain;
        allow-update { any; };

diff --git a/bin/tests/system/dnssec/ns3/named.conf.in b/bin/tests/system/dnssec/ns3/named.conf.in
index 233db0cc91d933236646fd21070f24b79dcdf7ff..7262359b3231b798a91718518685ea0863a4189f 100644 (file)
--- a/bin/tests/system/dnssec/ns3/named.conf.in
+++ b/bin/tests/system/dnssec/ns3/named.conf.in
@@ -284,6 +284,7 @@ zone "publish-inactive.example" {
        type primary;
        file "publish-inactive.example.db";
        auto-dnssec maintain;
+       dnssec-dnskey-kskonly no;
        update-policy local;
 };
 

diff --git a/bin/tests/system/inline/ns3/named.conf.in b/bin/tests/system/inline/ns3/named.conf.in
index 8ccfaf7d2fe0442a6f2bfc31251c9248444cbdb7..433e9fae169a7df8bdeb9baa184e931cbaf3245c 100644 (file)
--- a/bin/tests/system/inline/ns3/named.conf.in
+++ b/bin/tests/system/inline/ns3/named.conf.in
@@ -108,6 +108,7 @@ zone "externalkey" {
        type primary;
        inline-signing yes;
        auto-dnssec maintain;
+       dnssec-dnskey-kskonly no;
        allow-update { any; };
        file "externalkey.db";
 };

diff --git a/bin/tests/system/views/ns2/named1.conf.in b/bin/tests/system/views/ns2/named1.conf.in
index 64ac6fa8d9952d05765c034694b409c59387c29d..b3203579b15ca94208281a24a0f851fae13608bc 100644 (file)
--- a/bin/tests/system/views/ns2/named1.conf.in
+++ b/bin/tests/system/views/ns2/named1.conf.in
@@ -48,4 +48,5 @@ zone "inline" {
        key-directory "external";
        auto-dnssec maintain;
        inline-signing yes;
+       dnssec-dnskey-kskonly no;
 };

diff --git a/bin/tests/system/views/ns2/named2.conf.in b/bin/tests/system/views/ns2/named2.conf.in
index 66713fcf8a2b5fd1994f8796e8a7c668a0e5c2bd..f4e96b66634fdadfa03120bfd57f3480eef82539 100644 (file)
--- a/bin/tests/system/views/ns2/named2.conf.in
+++ b/bin/tests/system/views/ns2/named2.conf.in
@@ -62,6 +62,7 @@ view "internal" {
                key-directory "internal";
                auto-dnssec maintain;
                inline-signing yes;
+               dnssec-dnskey-kskonly no;
        };
 };
 
@@ -94,5 +95,6 @@ view "external" {
                key-directory "external";
                auto-dnssec maintain;
                inline-signing yes;
+               dnssec-dnskey-kskonly no;
        };
 };

diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index 6db12cc859b8f6a70d3285ac7e68e15b4004add2..b6b384d292003a089263399eebf49fcc5c40f6f3 100644 (file)
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -2218,7 +2218,7 @@ Boolean Options
    the remainder of the zone, but not the DNSKEY RRset. This is similar
    to the ``dnssec-signzone -x`` command-line option.
 
-   The default is ``no``. If ``update-check-ksk`` is set to ``no``, this
+   The default is ``yes``. If ``update-check-ksk`` is set to ``no``, this
    option is ignored.
 
 ``try-tcp-refresh``