Hi!
I use Bind 9.9.5 for inline signing. The zone is configured to use NSEC3
without opt-out:
example.com 0 IN NSEC3PARAM 1 0 10 BEEF
Nevertheless, most of the resulting NSEC3 records have the opt-out bit
set and insecure delegations are indeed skipped (no NSEC3 records for
insecure delegations), eg:
V24FPFCF9JU69PJH09ID0VEGDKLSN410.nic.at. 900 IN NSEC3 1 1 10
BEEF 0OTL3SD4PC0BGU4IVRM0DI2OV4DE8QQN A RRSIG
The only NSEC3 records having the opt-out bit cleared are the NSEC3
records for empty non-terminals, eg:
V1PD6GJFRL9AKKJLS8SLSFGE4D506CFN.example.com. 900 IN NSEC3 1 0
10 BEEF V24FPFCF9JU69PJH09ID0VEGDKLSN410
So, I am confused.
1. Why does Bind uses opt-out although it is configured to not use opt-out?
2. What would be the behavior for empty non-terminal NSEC3 records if
opt-out is enabled? Would the generated NSEC3 record still have the
opt-out bit cleared?
Thanks
Klaus
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
