Use NSEC3 guidance values in nsec3 config examples

Use best practice values in examples that follow new guidance from
draft-ietf-dnsop-nsec3-guidance:

   ; SHA-1, no extra iterations, empty salt:
   ;
   bcp.example. IN NSEC3PARAM 1 0 0 -

diff --git a/doc/arm/dnssec.inc.rst b/doc/arm/dnssec.inc.rst
index 98c70e0c49a4c5870eb134d9993ee7cc8437bd53..8e87aa4e6908aca0710bd1b76b482bd4beca9fd0 100644 (file)
--- a/doc/arm/dnssec.inc.rst
+++ b/doc/arm/dnssec.inc.rst
@@ -160,14 +160,14 @@ To enable ``NSEC3``, add an ``nsec3param`` option to your DNSSEC Policy:
 ::
 
     dnssec-policy "nsec3" {
-        nsec3param iterations 5 optout yes salt-length 8;
+        nsec3param iterations 0 optout no salt-length 0;
     };
 
 ..
 
 The ``nsec3`` policy above creates ``NSEC3`` records using the SHA-1 hash
-algorithm, using 5 iterations and a salt that is 8 characters long. It also
-skips insecure delegations.
+algorithm, using zero extra iterations and no salt. ``optout`` is disabled,
+meaning insecure delegations will also get an ``NSEC3`` record.
 
 The ``NSEC3`` chain is generated and the ``NSEC3PARAM`` record is added before
 the existing ``NSEC`` chain (if any) is destroyed.