Bug description
roles/bind/templates/etc/named.conf.j2 (line 36) sets dnssec-validation no;, while the named.conf shipped by the bind package sets dnssec-validation yes;. The value has been hardcoded since the role was added, is not exposed as a variable and is not mentioned in the README. A resolver deployed with the role therefore does not detect forged answers for DNSSEC-signed zones that a stock installation would reject.
Steps to reproduce
- Deploy the role.
- Run
named-checkconf -p | grep dnssec-validation, which prints dnssec-validation no;.
Expected behavior
DNSSEC validation on by default, matching the package and the "Security by Default" rule in CONTRIBUTING.md, with a variable to turn it off for environments whose forwarders break DNSSEC. If the default stays off, the README needs a "Deviates from the upstream default" note explaining why.
Environment
LFOps main; bind 9.16.23 on Rocky 9 and 9.18.33 on Rocky 10, both shipping the same named.conf.
Additional context
Turning validation on changes behaviour for existing resolvers.
Bug description
roles/bind/templates/etc/named.conf.j2(line 36) setsdnssec-validation no;, while thenamed.confshipped by the bind package setsdnssec-validation yes;. The value has been hardcoded since the role was added, is not exposed as a variable and is not mentioned in the README. A resolver deployed with the role therefore does not detect forged answers for DNSSEC-signed zones that a stock installation would reject.Steps to reproduce
named-checkconf -p | grep dnssec-validation, which printsdnssec-validation no;.Expected behavior
DNSSEC validation on by default, matching the package and the "Security by Default" rule in CONTRIBUTING.md, with a variable to turn it off for environments whose forwarders break DNSSEC. If the default stays off, the README needs a "Deviates from the upstream default" note explaining why.
Environment
LFOps main; bind 9.16.23 on Rocky 9 and 9.18.33 on Rocky 10, both shipping the same
named.conf.Additional context
Turning validation on changes behaviour for existing resolvers.