[3/3,v3] Unbound: Use aggressive NSEC

Message ID fe989732-7d8c-b706-a694-5b03669fccfd@link38.eu
State Superseded
Headers
Series [1/3,v3] Unbound: Enable DNS cache poisoning mitigation |

Commit Message

Peter Müller Aug. 28, 2018, 1:29 a.m. UTC
  This avoids some needless lookups to destination domains
with a very high NXDOMAIN rate and reduces load on upstream
servers.

See https://nlnetlabs.nl/documentation/unbound/unbound.conf/
for further details.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
---
 config/unbound/unbound.conf | 1 +
 1 file changed, 1 insertion(+)
  

Patch

diff --git a/config/unbound/unbound.conf b/config/unbound/unbound.conf
index 8b5d34ee3..8ad6bcb03 100644
--- a/config/unbound/unbound.conf
+++ b/config/unbound/unbound.conf
@@ -60,6 +60,7 @@  server:
 	harden-referral-path: yes
 	harden-algo-downgrade: no
 	use-caps-for-id: yes
+	aggressive-nsec: yes
 
 	# Harden against DNS cache poisoning
 	unwanted-reply-threshold: 5000000