From: Tinderbox User <tbox@isc.org>
Date: Sat, 23 Jul 2016 01:08:43 +0000 (+0000)
Subject: regen master
X-Git-Tag: v9.12.0a0~142
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=e31a24d05be7fe16d842dd7e83ef08d8860d3c4c;p=thirdparty%2Fbind9.git

regen master
---

diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html
index 4069e6b1f42..c6dbfef797d 100644
--- a/doc/arm/Bv9ARM.ch06.html
+++ b/doc/arm/Bv9ARM.ch06.html
@@ -3985,6 +3985,34 @@ options {
                   </p>
 </div>
 </dd>
+<dt><span class="term"><span class="command"><strong>trust-anchor-telemetry</strong></span></span></dt>
+<dd>
+<p>
+                  Causes <span class="command"><strong>named</strong></span> to send specially-formed
+                  queries once per day to domains for which trust anchors
+                  have been configured via <span class="command"><strong>trusted-keys</strong></span>,
+                  <span class="command"><strong>managed-keys</strong></span>,
+                  <span class="command"><strong>dnssec-validation auto</strong></span>, or
+                  <span class="command"><strong>dnssec-lookaside auto</strong></span>.
+                </p>
+<p>
+                  The query name used for these queries has the
+                  form "_ta-xxxx(-xxxx)(...)".&lt;domain&gt;, where
+                  each "xxxx" is a group of four hexadecimal digits
+                  representing the key ID of a trusted DNSSEC key.
+                  The key IDs for each domain are sorted smallest
+                  to largest prior to encoding. The query type is NULL.
+                </p>
+<p>
+                  By monitoring these queries, zone operators will
+                  be able to see which resolvers have been updated to
+                  trust a new key; this may help them decide when it
+                  is safe to remove an old one.
+                </p>
+<p>
+                  The default is <strong class="userinput"><code>yes</code></strong>.
+                </p>
+</dd>
 <dt><span class="term"><span class="command"><strong>use-id-pool</strong></span></span></dt>
 <dd><p>
                   <span class="emphasis"><em>This option is obsolete</em></span>.
diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html
index 5c33e1a3104..9c7ebab5870 100644
--- a/doc/arm/Bv9ARM.ch09.html
+++ b/doc/arm/Bv9ARM.ch09.html
@@ -570,6 +570,17 @@
 	  name rather than returning all of the matching RRsets.
 	  Thanks to Tony Finch for the contribution. [RT #41615]
 	</p></li>
+<li class="listitem"><p>
+	  <span class="command"><strong>named</strong></span> now provides feedback to the
+	  owners of zones which have trust anchors configured
+	  (<span class="command"><strong>trusted-keys</strong></span>,
+	  <span class="command"><strong>managed-keys</strong></span>, <span class="command"><strong>dnssec-validation
+	  auto;</strong></span> and <span class="command"><strong>dnssec-lookaside auto;</strong></span>)
+	  by sending a daily query which encodes the keyids of the
+	  configured trust anchors for the zone.  This is controlled
+	  by <span class="command"><strong>trust-anchor-telemetry</strong></span> and defaults
+	  to yes.
+	</p></li>
 </ul></div>
 </div>
 <div class="section">
diff --git a/doc/arm/notes.html b/doc/arm/notes.html
index 2b7bab524dd..599078a8e62 100644
--- a/doc/arm/notes.html
+++ b/doc/arm/notes.html
@@ -531,6 +531,17 @@
 	  name rather than returning all of the matching RRsets.
 	  Thanks to Tony Finch for the contribution. [RT #41615]
 	</p></li>
+<li class="listitem"><p>
+	  <span class="command"><strong>named</strong></span> now provides feedback to the
+	  owners of zones which have trust anchors configured
+	  (<span class="command"><strong>trusted-keys</strong></span>,
+	  <span class="command"><strong>managed-keys</strong></span>, <span class="command"><strong>dnssec-validation
+	  auto;</strong></span> and <span class="command"><strong>dnssec-lookaside auto;</strong></span>)
+	  by sending a daily query which encodes the keyids of the
+	  configured trust anchors for the zone.  This is controlled
+	  by <span class="command"><strong>trust-anchor-telemetry</strong></span> and defaults
+	  to yes.
+	</p></li>
 </ul></div>
 </div>
 <div class="section">
diff --git a/doc/misc/options b/doc/misc/options
index 8bbfb1d97a0..b2277b90b10 100644
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -322,6 +322,7 @@ options {
         transfers-out <integer>;
         transfers-per-ns <integer>;
         treat-cr-as-space <boolean>; // obsolete
+        trust-anchor-telemetry <boolean>;
         try-tcp-refresh <boolean>;
         update-check-ksk <boolean>;
         use-alt-transfer-source <boolean>;
@@ -608,6 +609,7 @@ view <string> [ <class> ] {
             dscp <integer> ];
         transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * )
             ] [ dscp <integer> ];
+        trust-anchor-telemetry <boolean>;
         trusted-keys { <string> <integer> <integer> <integer>
             <quoted_string>; ... };
         try-tcp-refresh <boolean>;