regen master

diff --git a/bin/dnssec/dnssec-signzone.8 b/bin/dnssec/dnssec-signzone.8
index f0807dec733d556d798a6b9f7d14f875c5ac7865..e95043ce0343cca9cb3acd61c899e6ba4448be67 100644 (file)
--- a/bin/dnssec/dnssec-signzone.8
+++ b/bin/dnssec/dnssec-signzone.8
@@ -376,7 +376,7 @@ Sets the debugging level\&.
 .PP
 \-x
 .RS 4
-Only sign the DNSKEY RRset with key\-signing keys, and omit signatures from zone\-signing keys\&. (This is similar to the
+Only sign the DNSKEY, CDNSKEY, and CDS RRsets with key\-signing keys, and omit signatures from zone\-signing keys\&. (This is similar to the
 \fBdnssec\-dnskey\-kskonly yes;\fR
 zone option in
 \fBnamed\fR\&.)

diff --git a/bin/dnssec/dnssec-signzone.html b/bin/dnssec/dnssec-signzone.html
index 9232ee433599343f5b6c4f3d867193c1aecea4c6..45d84c12db2fbb528f32b61307c41be79244e563 100644 (file)
--- a/bin/dnssec/dnssec-signzone.html
+++ b/bin/dnssec/dnssec-signzone.html
@@ -563,8 +563,9 @@
 <dt><span class="term">-x</span></dt>
 <dd>
           <p>
-            Only sign the DNSKEY RRset with key-signing keys, and omit
-            signatures from zone-signing keys.  (This is similar to the
+            Only sign the DNSKEY, CDNSKEY, and CDS RRsets with
+            key-signing keys, and omit signatures from zone-signing
+            keys. (This is similar to the
             <span class="command"><strong>dnssec-dnskey-kskonly yes;</strong></span> zone option in
             <span class="command"><strong>named</strong></span>.)
           </p>

diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html
index 9a0b59fb9e58255cd6bf3324ebc5db046f96ba8b..d83a0beec7f1fd95fcf46f5a295f667d063b6721 100644 (file)
--- a/doc/arm/Bv9ARM.ch06.html
+++ b/doc/arm/Bv9ARM.ch06.html
@@ -4911,9 +4911,9 @@ options {
                   When this option and <span class="command"><strong>update-check-ksk</strong></span>
                   are both set to <code class="literal">yes</code>, only key-signing
                   keys (that is, keys with the KSK bit set) will be used
-                  to sign the DNSKEY RRset at the zone apex.  Zone-signing
-                  keys (keys without the KSK bit set) will be used to sign
-                  the remainder of the zone, but not the DNSKEY RRset.
+                  to sign the DNSKEY, CDNSKEY, and CDS RRsets at the zone apex.
+                  Zone-signing keys (keys without the KSK bit set) will be used
+                  to sign the remainder of the zone, but not the DNSKEY RRset.
                   This is similar to the
                   <span class="command"><strong>dnssec-signzone -x</strong></span> command line option.
                 </p>

diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html
index 8ea62690d3528010a10474de0db44d2142d6622e..a160d5a9850163c2eb25b3a51fc596ed606b870e 100644 (file)
--- a/doc/arm/Bv9ARM.ch09.html
+++ b/doc/arm/Bv9ARM.ch09.html
@@ -528,6 +528,22 @@
          matching <span class="command"><strong>cookie-secret</strong></span>.
        </p>
       </li>
+<li class="listitem">
+       <p>
+         A new statistics counter has been added to track prefetch
+         queries. [RT #45847]
+       </p>
+      </li>
+<li class="listitem">
+       <p>
+         The <span class="command"><strong>dnssec-signzone -x</strong></span> flag and the
+         <span class="command"><strong>dnssec-dnskey-kskonly</strong></span> option in
+         <span class="command"><strong>named.conf</strong></span>, which suppress the use of
+         the ZSK when signing DNSKEY records, now also apply to
+         CDNSKEY and CDS records. Thanks to Tony Finch for the
+         contribution. [RT #45689]
+       </p>
+      </li>
 </ul></div>
   </div>
 

diff --git a/doc/arm/man.dnssec-signzone.html b/doc/arm/man.dnssec-signzone.html
index 5d167c9dd08519b942c874ffc4034d84b8f9fc59..0924d32331f98044e0e22d4c4063f518f69ff16c 100644 (file)
--- a/doc/arm/man.dnssec-signzone.html
+++ b/doc/arm/man.dnssec-signzone.html
@@ -581,8 +581,9 @@
 <dt><span class="term">-x</span></dt>
 <dd>
           <p>
-            Only sign the DNSKEY RRset with key-signing keys, and omit
-            signatures from zone-signing keys.  (This is similar to the
+            Only sign the DNSKEY, CDNSKEY, and CDS RRsets with
+            key-signing keys, and omit signatures from zone-signing
+            keys. (This is similar to the
             <span class="command"><strong>dnssec-dnskey-kskonly yes;</strong></span> zone option in
             <span class="command"><strong>named</strong></span>.)
           </p>

diff --git a/doc/arm/notes.html b/doc/arm/notes.html
index a8d76cd54eda07675ee94a16cbeb7c7a302ba3eb..aca91d44d3640fff2d9334759aace16a973b70d7 100644 (file)
--- a/doc/arm/notes.html
+++ b/doc/arm/notes.html
@@ -489,6 +489,22 @@
          matching <span class="command"><strong>cookie-secret</strong></span>.
        </p>
       </li>
+<li class="listitem">
+       <p>
+         A new statistics counter has been added to track prefetch
+         queries. [RT #45847]
+       </p>
+      </li>
+<li class="listitem">
+       <p>
+         The <span class="command"><strong>dnssec-signzone -x</strong></span> flag and the
+         <span class="command"><strong>dnssec-dnskey-kskonly</strong></span> option in
+         <span class="command"><strong>named.conf</strong></span>, which suppress the use of
+         the ZSK when signing DNSKEY records, now also apply to
+         CDNSKEY and CDS records. Thanks to Tony Finch for the
+         contribution. [RT #45689]
+       </p>
+      </li>
 </ul></div>
   </div>