Ability to exclude a domain from DNSSEC validation?

Unbound
1

Hello, I am new to Unbound, and I was wondering if there is an easy
way to exclude a particular domain from DNSSEC validation.

For example if a popular site ( say nasa.gov ) updates their keys
incorrectly so that their domain fails validation, you contact their
admins. and with a high level of confidence you determine this is a
configuration mistake and not a security breach, you can then exclude
them from DNSSEC validation so your customers can access their site
while they fix their error.

I think I can accomplish this with a "stub-zone", but if there is some
"skip-dnssec" configuration option, that seems easier.

Does anyone have any suggestions or thoughts?

2

Hi Augie,

Unbound has the 'domain-insecure' option for this: http://unbound.net/documentation/unbound.conf.html

Cheers,

3

Augie,

Hello, I am new to Unbound, and I was wondering if there is an easy
way to exclude a particular domain from DNSSEC validation.

Use Unbound's "domain-insecure" option, which you add to unbound.conf or
add on-the-fly to the running server with `unbound-control'. (Note that
ading on-the-fly doesn't survive a server restart.)

        -JP

4

Excellent! Works like a charm, thank you. --Augie