diff mbox series

[v4,3/3] Unbound: Use aggressive NSEC

Message ID 20180910142126.5265-3-peter.mueller@link38.eu
State Accepted
Commit 8a0585837c4f743676a27ad16212a68b8fb4172b
Headers
Series [v4,1/3] Unbound: Enable DNS cache poisoning mitigation |

Commit Message

Peter Müller Sept. 11, 2018, 12:21 a.m. UTC 
  This avoids some needless lookups to destination domains
with a very high NXDOMAIN rate and reduces load on upstream
servers.

See https://nlnetlabs.nl/documentation/unbound/unbound.conf/
for further details.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
---
 config/unbound/unbound.conf | 1 +
 1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/config/unbound/unbound.conf b/config/unbound/unbound.conf
index 6eaf70a8e..cda591dab 100644
--- a/config/unbound/unbound.conf
+++ b/config/unbound/unbound.conf
@@ -60,6 +60,7 @@  server:
 	harden-referral-path: yes
 	harden-algo-downgrade: no
 	use-caps-for-id: yes
+	aggressive-nsec: yes
 
 	# Harden against DNS cache poisoning
 	unwanted-reply-threshold: 1000000