<para>
The logged error reads "insecurity proof failed" and
"got insecure response; parent indicates it should be secure".
- (Prior to BIND 9.7, the logged error was "not insecure".
- This referred to the zone, not the response.)
</para>
</note>
</section>
A <command>managed-keys</command> statement contains a list of
the keys to be managed, along with information about how the
keys are to be initialized for the first time. The only
- initialization method currently supported (as of
- <acronym>BIND</acronym> 9.7.0) is <literal>initial-key</literal>.
+ initialization method currently supported is
+ <literal>initial-key</literal>.
This means the <command>managed-keys</command> statement must
contain a copy of the initializing key. (Future releases may
allow keys to be initialized by other methods, eliminating this
<!-- Converted by db4-upgrade version 1.0 -->
<section xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="dnssec.dynamic.zones"><info><title>DNSSEC, Dynamic Zones, and Automatic Signing</title></info>
- <para>As of BIND 9.7.0 it is possible to change a dynamic zone
- from insecure to signed and back again. A secure zone can use
- either NSEC or NSEC3 chains.</para>
<section><info><title>Converting from insecure to secure</title></info>
</section>
<!-- Converted by db4-upgrade version 1.0 -->
<section xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="rfc5011.support"><info><title>Dynamic Trust Anchor Management</title></info>
- <para>BIND 9.7.0 introduces support for RFC 5011, dynamic trust
- anchor management. Using this feature allows
- <command>named</command> to keep track of changes to critical
- DNSSEC keys without any need for the operator to make changes to
- configuration files.</para>
+ <para>
+ BIND is able to maintain DNSSEC trust anchors using RFC 5011 key
+ management. This feature allows <command>named</command> to keep track
+ of changes to critical DNSSEC keys without any need for the operator to
+ make changes to configuration files.
+ </para>
+
<section><info><title>Validating Resolver</title></info>
<!-- TODO: command tag is overloaded for configuration and executables -->