disable checks by default in named-compilezone

Zone content integrity checks can significantly slow the conversion
of zones from raw to text. As this is more properly a job for
named-checkzone anyway, we now disable all zone checks by
default in named-compilezone.

Users relying on named-compilezone for integrity checks as
well as format conversion can run named-checkzone separately,
or re-enable the checks in named-compilezone by using:
"named-compilezone -n fail -k fail -r warn -T warn -W warn".

diff --git a/bin/check/check-tool.c b/bin/check/check-tool.c
index 93cde4055046fb31f80c9945ef3e27e796859815..438ca51c8c6af62b2a9a4456dce169c08a36c527 100644 (file)
--- a/bin/check/check-tool.c
+++ b/bin/check/check-tool.c
@@ -88,6 +88,7 @@ bool dochecksrv = false;
 bool docheckns = false;
 #endif /* if CHECK_LOCAL */
 dns_zoneopt_t zone_options = DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_CHECKMX |
+                            DNS_ZONEOPT_CHECKDUPRR | DNS_ZONEOPT_CHECKSPF |
                             DNS_ZONEOPT_MANYERRORS | DNS_ZONEOPT_CHECKNAMES |
                             DNS_ZONEOPT_CHECKINTEGRITY |
 #if CHECK_SIBLING

diff --git a/bin/check/named-checkzone.c b/bin/check/named-checkzone.c
index 795624651ad82bf4c60e5ddbf417c671e4019b87..da909d67de7325647d385b94963371223626e281 100644 (file)
--- a/bin/check/named-checkzone.c
+++ b/bin/check/named-checkzone.c
@@ -147,15 +147,12 @@ main(int argc, char **argv) {
                UNREACHABLE();
        }
 
-       /* Compilation specific defaults */
+       /* When compiling, disable checks by default */
        if (progmode == progmode_compile) {
-               zone_options |= (DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_FATALNS |
-                                DNS_ZONEOPT_CHECKSPF | DNS_ZONEOPT_CHECKDUPRR |
-                                DNS_ZONEOPT_CHECKNAMES |
-                                DNS_ZONEOPT_CHECKNAMESFAIL |
-                                DNS_ZONEOPT_CHECKWILDCARD);
-       } else {
-               zone_options |= (DNS_ZONEOPT_CHECKDUPRR | DNS_ZONEOPT_CHECKSPF);
+               zone_options = 0;
+               docheckmx = false;
+               docheckns = false;
+               dochecksrv = false;
        }
 
 #define ARGCMP(X) (strcmp(isc_commandline_argument, X) == 0)

diff --git a/bin/check/named-compilezone.rst b/bin/check/named-compilezone.rst
index 0b4c98d4494db226a5912c43e904916c19ca176b..8c68d0d6d2993f6cb3170126ee021286851d58b8 100644 (file)
--- a/bin/check/named-compilezone.rst
+++ b/bin/check/named-compilezone.rst
@@ -30,10 +30,16 @@ Description
 
 :program:`named-compilezone` checks the syntax and integrity of a zone file,
 and dumps the zone contents to a specified file in a specified format.
-It applies strict check levels by default, since the
-dump output is used as an actual zone file loaded by :iscman:`named`.
-When manually specified otherwise, the check levels must at least be as
-strict as those specified in the :iscman:`named` configuration file.
+
+Unlike :program:`named-checkzone`, zone contents are not strictly checked
+by default. If the output is to be used as an actual zone file to be loaded
+by :iscman:`named`, then the check levels should be manually configured to
+be at least as strict as those specified in the :iscman:`named` configuration
+file.
+
+Running :program:`named-checkzone` on the input prior to compiling will
+ensure that the zone compiles with the default requirements of
+:iscman:`named`.
 
 Options
 ~~~~~~~
@@ -77,13 +83,13 @@ Options
 
    ``check-svcb:fail`` turns on additional checks on ``_dns`` SVCB
    records and ``check-svcb:ignore`` disables these checks.  The
-   default is ``check-svcb:fail``.
+   default is ``check-svcb:ignore``.
 
 .. option:: -i mode
 
    This option performs post-load zone integrity checks. Possible modes are
-   ``full`` (the default), ``full-sibling``, ``local``,
-   ``local-sibling``, and ``none``.
+   ``full``, ``full-sibling``, ``local``,
+   ``local-sibling``, and ``none`` (the default).
 
    Mode ``full`` checks that MX records refer to A or AAAA records
    (both in-zone and out-of-zone hostnames). Mode ``local`` only
@@ -127,7 +133,7 @@ Options
 .. option:: -k mode
 
    This option performs ``check-names`` checks with the specified failure mode.
-   Possible modes are ``fail`` (the default), ``warn``, and ``ignore``.
+   Possible modes are ``fail``, ``warn``, and ``ignore`` (the default).
 
 .. option:: -l ttl
 
@@ -144,19 +150,19 @@ Options
 .. option:: -m mode
 
    This option specifies whether MX records should be checked to see if they are
-   addresses. Possible modes are ``fail``, ``warn`` (the default), and
-   ``ignore``.
+   addresses. Possible modes are ``fail``, ``warn``, and
+   ``ignore`` (the default).
 
 .. option:: -M mode
 
    This option checks whether a MX record refers to a CNAME. Possible modes are
-   ``fail``, ``warn`` (the default), and ``ignore``.
+   ``fail``, ``warn``, and ``ignore`` (the default).
 
 .. option:: -n mode
 
    This option specifies whether NS records should be checked to see if they are
-   addresses. Possible modes are ``fail`` (the default), ``warn``,  and
-   ``ignore``.
+   addresses. Possible modes are ``fail``, ``warn``,  and
+   ``ignore`` (the default).
 
 .. option:: -o filename
 
@@ -167,7 +173,7 @@ Options
 
    This option checks for records that are treated as different by DNSSEC but are
    semantically equal in plain DNS. Possible modes are ``fail``,
-   ``warn`` (the default), and ``ignore``.
+   ``warn``, and ``ignore`` (the default).
 
 .. option:: -s style
 
@@ -180,7 +186,7 @@ Options
 .. option:: -S mode
 
    This option checks whether an SRV record refers to a CNAME. Possible modes are
-   ``fail``, ``warn`` (the default), and ``ignore``.
+   ``fail``, ``warn``, and ``ignore`` (the default).
 
 .. option:: -t directory
 
@@ -192,7 +198,7 @@ Options
 
    This option checks whether Sender Policy Framework (SPF) records exist and issues a
    warning if an SPF-formatted TXT record is not also present. Possible
-   modes are ``warn`` (the default) and ``ignore``.
+   modes are ``warn`` and ``ignore`` (the default).
 
 .. option:: -w directory
 
@@ -210,7 +216,7 @@ Options
    This option specifies whether to check for non-terminal wildcards. Non-terminal
    wildcards are almost always the result of a failure to understand the
    wildcard matching algorithm (:rfc:`4592`). Possible modes are ``warn``
-   (the default) and ``ignore``.
+   and ``ignore`` (the default).
 
 .. option:: zonename