diff mbox series

[v4,2/3] Unbound: Use caps for IDs

Message ID 20180910142126.5265-2-peter.mueller@link38.eu
State Accepted
Commit 4e4128faacab7a25e5845faffefa2b2b2128eff7
Headers
Series [v4,1/3] Unbound: Enable DNS cache poisoning mitigation |

Commit Message

Peter Müller Sept. 11, 2018, 12:21 a.m. UTC 
  Attempt to detect DNS spoofing attacks by inserting 0x20-encoded
random bits into upstream queries. Upstream documentation claims
it to be an experimental implementation, it did not cause any trouble
on productive systems here.

See https://nlnetlabs.nl/documentation/unbound/unbound.conf/ for
further details.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
---
 config/unbound/unbound.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/config/unbound/unbound.conf b/config/unbound/unbound.conf
index ce9ddcd62..6eaf70a8e 100644
--- a/config/unbound/unbound.conf
+++ b/config/unbound/unbound.conf
@@ -59,7 +59,7 @@  server:
 	harden-below-nxdomain: yes
 	harden-referral-path: yes
 	harden-algo-downgrade: no
-	use-caps-for-id: no
+	use-caps-for-id: yes
 
 	# Harden against DNS cache poisoning
 	unwanted-reply-threshold: 1000000