Re: Allow response with AD bit in resolver

Greetings, On Mon, 17 Jun 2024 19:08:22 +0100, J Carter wrote: > > It's caused by DNS Cache poisoning (either intentionally, or > unintentionally), from a recursive resolver that caches CD bit but > does not zero it if a non dns-sec query hits that cached response. > > I see unbound also has a

Re: Allow response with AD bit in resolver

Hello, On Mon, 17 Jun 2024 10:22:24 +0100 Kirill A. Korinsky wrote: > On Mon, 17 Jun 2024 00:21:27 +0100, > J Carter wrote: > > > > Well *I* quite agree. > > > > I would also suggest that as DNS functionality in nginx is strictly > > limited to resolving as client in quite a simplistic fashion,

Re: Allow response with AD bit in resolver

On Mon, 17 Jun 2024 00:21:27 +0100, J Carter wrote: > > Well *I* quite agree. > > I would also suggest that as DNS functionality in nginx is strictly > limited to resolving as client in quite a simplistic fashion, and nginx > does not support DNSSEC, it makes little sense to hyper-strict about > t