.. option:: negative-trust-anchors: <list of domain names>
When you use a domain name as an *negative trust anchor* (NTA), DNSSEC validation will be turned off at/below these names.
- If you want to disable DNSSEC validation completely, set ``dnssec: false`` instead.
+ If you want to disable DNSSEC validation completely, set ``dnssec/enable: false`` instead (see above).
.. code-block:: yaml
.. SPDX-License-Identifier: GPL-3.0-or-later
-.. _config-serve-stale:
+.. _config-fallback:
Fallback on resolution failure
==============================
.. literalinclude:: ../../systemd/knot-resolver.service.in
- :language: bash
+ :language: systemd
.. note::
- Replace words surrounded by ``@`` to some real values (i.e. ``@user@`` to a user you want Knot Resolver to run as).
\ No newline at end of file
+ Replace words surrounded by ``@`` to some real values (i.e. ``@user@`` to a user you want Knot Resolver to run as).
**Reloading configuration** may fail, even when your configuration is valid, because some options cannot be changed while running.
You can always find an explanation of the error in the log accesed by the ``journalctl -eu knot-resolver`` command.
+.. for these cases see: git grep '\<_deny_' python/
===============================
Listening on network interfaces
) -> Result[None, str]:
if config_old.management != config_new.management:
return Result.err(
- "/server/management: Changing management API address/uTruenix-socket dynamically is not allowed as it's really dangerous."
+ "/server/management: Changing management API address/unix-socket dynamically is not allowed as it's really dangerous."
" If you really need this feature, please contact the developers and explain why. Technically,"
" there are no problems in supporting it. We are only blocking the dynamic changes because"
" we think the consequences of leaving this footgun unprotected are worse than its usefulness."