Hi,
You are right, I meant "nsec3param salt-length".
On 10/8/26 11:34, pgnd wrote:
Thus, I am notifying you that we intend to end support for the "nsec3
salt-length" (inside dnssec-policy) option in named. Our plan is to
mark them as deprecated in BIND 9.20, and remove them completely as of
BIND 9.22.
@ https://bind9.readthedocs.io/en/latest/dnssec-guide.html#advanced-
discussions-nsec3-salt
there's no reference to a literal "nsec3 salt-length"
rather, usage in policy of "nsec3param ..."
nsec3param iterations 0 optout no salt-length 0;
just to confirm, the removal will then require
- nsec3param iterations 0 optout no salt-length 0;
+ nsec3param iterations 0 optout no;
?
Yes,
with the salt-length hardwired == 0?
And yes.
--
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from
this list.
