regen master

diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html
index 4069e6b1f421897e90e8590d2c87f97212c95feb..c6dbfef797d050ed83ebfe28520b1f2c058ef66e 100644 (file)
--- a/doc/arm/Bv9ARM.ch06.html
+++ b/doc/arm/Bv9ARM.ch06.html
@@ -3985,6 +3985,34 @@ options {
                   </p>
 </div>
 </dd>
+<dt><span class="term"><span class="command"><strong>trust-anchor-telemetry</strong></span></span></dt>
+<dd>
+<p>
+                  Causes <span class="command"><strong>named</strong></span> to send specially-formed
+                  queries once per day to domains for which trust anchors
+                  have been configured via <span class="command"><strong>trusted-keys</strong></span>,
+                  <span class="command"><strong>managed-keys</strong></span>,
+                  <span class="command"><strong>dnssec-validation auto</strong></span>, or
+                  <span class="command"><strong>dnssec-lookaside auto</strong></span>.
+                </p>
+<p>
+                  The query name used for these queries has the
+                  form "_ta-xxxx(-xxxx)(...)".&lt;domain&gt;, where
+                  each "xxxx" is a group of four hexadecimal digits
+                  representing the key ID of a trusted DNSSEC key.
+                  The key IDs for each domain are sorted smallest
+                  to largest prior to encoding. The query type is NULL.
+                </p>
+<p>
+                  By monitoring these queries, zone operators will
+                  be able to see which resolvers have been updated to
+                  trust a new key; this may help them decide when it
+                  is safe to remove an old one.
+                </p>
+<p>
+                  The default is <strong class="userinput"><code>yes</code></strong>.
+                </p>
+</dd>
 <dt><span class="term"><span class="command"><strong>use-id-pool</strong></span></span></dt>
 <dd><p>
                   <span class="emphasis"><em>This option is obsolete</em></span>.

diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html
index 5c33e1a3104c5ce87a6d52fc0df9e9e987298a76..9c7ebab5870013f50faafbab3945ee82be6909f7 100644 (file)
--- a/doc/arm/Bv9ARM.ch09.html
+++ b/doc/arm/Bv9ARM.ch09.html
@@ -570,6 +570,17 @@
          name rather than returning all of the matching RRsets.
          Thanks to Tony Finch for the contribution. [RT #41615]
        </p></li>
+<li class="listitem"><p>
+         <span class="command"><strong>named</strong></span> now provides feedback to the
+         owners of zones which have trust anchors configured
+         (<span class="command"><strong>trusted-keys</strong></span>,
+         <span class="command"><strong>managed-keys</strong></span>, <span class="command"><strong>dnssec-validation
+         auto;</strong></span> and <span class="command"><strong>dnssec-lookaside auto;</strong></span>)
+         by sending a daily query which encodes the keyids of the
+         configured trust anchors for the zone.  This is controlled
+         by <span class="command"><strong>trust-anchor-telemetry</strong></span> and defaults
+         to yes.
+       </p></li>
 </ul></div>
 </div>
 <div class="section">

diff --git a/doc/arm/notes.html b/doc/arm/notes.html
index 2b7bab524ddc99d688e5316127a0e182fcd94816..599078a8e626e9b4e3f57ce5cc746ad4d07ac645 100644 (file)
--- a/doc/arm/notes.html
+++ b/doc/arm/notes.html
@@ -531,6 +531,17 @@
          name rather than returning all of the matching RRsets.
          Thanks to Tony Finch for the contribution. [RT #41615]
        </p></li>
+<li class="listitem"><p>
+         <span class="command"><strong>named</strong></span> now provides feedback to the
+         owners of zones which have trust anchors configured
+         (<span class="command"><strong>trusted-keys</strong></span>,
+         <span class="command"><strong>managed-keys</strong></span>, <span class="command"><strong>dnssec-validation
+         auto;</strong></span> and <span class="command"><strong>dnssec-lookaside auto;</strong></span>)
+         by sending a daily query which encodes the keyids of the
+         configured trust anchors for the zone.  This is controlled
+         by <span class="command"><strong>trust-anchor-telemetry</strong></span> and defaults
+         to yes.
+       </p></li>
 </ul></div>
 </div>
 <div class="section">

diff --git a/doc/misc/options b/doc/misc/options
index 8bbfb1d97a02c4ee8a652f0984ee45d52f576d04..b2277b90b10b0f7adac9ec5ce9539fdcb5117d84 100644 (file)
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -322,6 +322,7 @@ options {
         transfers-out <integer>;
         transfers-per-ns <integer>;
         treat-cr-as-space <boolean>; // obsolete
+        trust-anchor-telemetry <boolean>;
         try-tcp-refresh <boolean>;
         update-check-ksk <boolean>;
         use-alt-transfer-source <boolean>;
@@ -608,6 +609,7 @@ view <string> [ <class> ] {
             dscp <integer> ];
         transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * )
             ] [ dscp <integer> ];
+        trust-anchor-telemetry <boolean>;
         trusted-keys { <string> <integer> <integer> <integer>
             <quoted_string>; ... };
         try-tcp-refresh <boolean>;