{"action":"created","comment":{"url":"https://api.github.com/repos/PowerDNS/pdns/pulls/comments/65681792","id":65681792,"diff_hunk":"@@ -0,0 +1,116 @@\n+# DNSSEC in the PowerDNS Recursor\n+As of 4.0.0, the PowerDNS Recursor has support for DNSSEC processing and\n+experimental support for DNSSEC validation.\n+\n+# DNSSEC settings\n+The PowerDNS Recursor has 5 different levels of DNSSEC processing, which can be\n+set with the [`dnssec`](settings.md#dnssec) setting in the `recursor.conf`. In\n+order from least to most processing, these are:\n+\n+## `off`\n+In this mode, **no** DNSSEC processing takes place. The PowerDNS Recursor will\n+not set the DNSSEC OK (DO) bit in the outgoing queries and will ignore the DO and\n+AD bits in queries. In this mode, the behaviour is equal to the PowerDNS Recursor\n+3.X.\n+\n+## `process-no-validate`\n+The default mode. In this mode the Recursor acts as a \"security aware, non-validating\"\n+nameserver, meaning it will set the DO-bit on outgoing queries and will provide\n+DNSSEC related RRsets (NSEC, RRSIG) to clients that ask for it (by means of a\n+DO-bit in the query). It will not do any validation in this mode, not even when\n+requested by the client.\n+\n+## `process`\n+When `dnssec` is set to `process` the behaviour is similar to [`process-no-validate`](#process-no-validate).\n+However, when the query has the AD-bit set, the recursor will try to validate the\n+data and set the AD-bit in the response when the data is validated and send a\n+SERVFAIL on a bogus answer.\n+\n+## `validate-log`\n+In this mode, the recursor will attempt to validate all data it retrieves from\n+authoritative servers, regardless of the client's DNSSEC desires, and will log the\n+validation result. This mode can be used to determine the extra load and amount\n+of possibly bogus answers before turning on full-blown validation.\n+\n+## `validate`\n+The highest mode of DNSSEC processing. In this mode, all queries will be be validated\n+and will be answered with a SERVFAIL in case of bogus data, regardless of the\n+client's request.\n+\n+## What, when?\n+The descriptions above are a bit terse, here's a table describing different scenarios\n+with regards to the `dnssec` mode.\n+\n+|    | `off` | `process-no-validate` | `process` | `validate-log` | `validate` |\n+|:------------|:-------|:-------------|:-------------|:-------------|:-------------|\n+|Perform validation| No | No | Only on +AD from client | Always (logs result) | Always |\n+|SERVFAIL on bogus| No | No | Only on +AD from client | Only on +AD from client | Always |\n+|AD in response on authenticated data| Never | Never | Only on +AD from client | Only on +AD from client | Only on +AD from client |\n+|RRSIGs/NSECs in answer on +DO from client| No | Yes | Yes | Yes | Yes |\n+\n+# Trust Anchor Management\n+The PowerDNS Recursor ships with the DNSSEC Root key built-in. However, all trust\n+anchors are configurable.\n+\n+## Trust Anchors\n+Configuring DNSSEC keys must be done in the [`lua-config-file`](settings.md#lua-config-file),\n+using `addDS`. This function takes 2 arguments, the node in the DNS-tree and the\n+data of the correspoding DS record. To e.g. add a trust anchor for the root and","path":"docs/markdown/recursor/dnssec.md","position":58,"original_position":58,"commit_id":"94dcacaa73fd2aa0f4466d448083c5be6ab4351d","original_commit_id":"94dcacaa73fd2aa0f4466d448083c5be6ab4351d","user":{"login":"Habbie","id":525838,"avatar_url":"https://avatars.githubusercontent.com/u/525838?v=3","gravatar_id":"","url":"https://api.github.com/users/Habbie","html_url":"https://github.com/Habbie","followers_url":"https://api.github.com/users/Habbie/followers","following_url":"https://api.github.com/users/Habbie/following{/other_user}","gists_url":"https://api.github.com/users/Habbie/gists{/gist_id}","starred_url":"https://api.github.com/users/Habbie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Habbie/subscriptions","organizations_url":"https://api.github.com/users/Habbie/orgs","repos_url":"https://api.github.com/users/Habbie/repos","events_url":"https://api.github.com/users/Habbie/events{/privacy}","received_events_url":"https://api.github.com/users/Habbie/received_events","type":"User","site_admin":false},"body":"corresponding. Do you have an i/aspell button in your editor? I find it is very useful.","created_at":"2016-06-03T09:42:48Z","updated_at":"2016-06-03T09:42:48Z","html_url":"https://github.com/PowerDNS/pdns/pull/3923#discussion_r65681792","pull_request_url":"https://api.github.com/repos/PowerDNS/pdns/pulls/3923","_links":{"self":{"href":"https://api.github.com/repos/PowerDNS/pdns/pulls/comments/65681792"},"html":{"href":"https://github.com/PowerDNS/pdns/pull/3923#discussion_r65681792"},"pull_request":{"href":"https://api.github.com/repos/PowerDNS/pdns/pulls/3923"}}},"pull_request":{"url":"https://api.github.com/repos/PowerDNS/pdns/pulls/3923","id":72180158,"html_url":"https://github.com/PowerDNS/pdns/pull/3923","diff_url":"https://github.com/PowerDNS/pdns/pull/3923.diff","patch_url":"https://github.com/PowerDNS/pdns/pull/3923.patch","issue_url":"https://api.github.com/repos/PowerDNS/pdns/issues/3923","number":3923,"state":"open","locked":false,"title":"Add Recursor DNSSEC docs","user":{"login":"pieterlexis","id":731232,"avatar_url":"https://avatars.githubusercontent.com/u/731232?v=3","gravatar_id":"","url":"https://api.github.com/users/pieterlexis","html_url":"https://github.com/pieterlexis","followers_url":"https://api.github.com/users/pieterlexis/followers","following_url":"https://api.github.com/users/pieterlexis/following{/other_user}","gists_url":"https://api.github.com/users/pieterlexis/gists{/gist_id}","starred_url":"https://api.github.com/users/pieterlexis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pieterlexis/subscriptions","organizations_url":"https://api.github.com/users/pieterlexis/orgs","repos_url":"https://api.github.com/users/pieterlexis/repos","events_url":"https://api.github.com/users/pieterlexis/events{/privacy}","received_events_url":"https://api.github.com/users/pieterlexis/received_events","type":"User","site_admin":false},"body":"Note, already contains docs on the non-merged #3910 code.","created_at":"2016-06-01T13:27:19Z","updated_at":"2016-06-03T09:42:49Z","closed_at":null,"merged_at":null,"merge_commit_sha":"f54088b0ff4351ed97c52e89c66ff147afbdaf29","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/PowerDNS/pdns/pulls/3923/commits","review_comments_url":"https://api.github.com/repos/PowerDNS/pdns/pulls/3923/comments","review_comment_url":"https://api.github.com/repos/PowerDNS/pdns/pulls/comments{/number}","comments_url":"https://api.github.com/repos/PowerDNS/pdns/issues/3923/comments","statuses_url":"https://api.github.com/repos/PowerDNS/pdns/statuses/94dcacaa73fd2aa0f4466d448083c5be6ab4351d","head":{"label":"pieterlexis:recursor-dnssec-docs","ref":"recursor-dnssec-docs","sha":"94dcacaa73fd2aa0f4466d448083c5be6ab4351d","user":{"login":"pieterlexis","id":731232,"avatar_url":"https://avatars.githubusercontent.com/u/731232?v=3","gravatar_id":"","url":"https://api.github.com/users/pieterlexis","html_url":"https://github.com/pieterlexis","followers_url":"https://api.github.com/users/pieterlexis/followers","following_url":"https://api.github.com/users/pieterlexis/following{/other_user}","gists_url":"https://api.github.com/users/pieterlexis/gists{/gist_id}","starred_url":"https://api.github.com/users/pieterlexis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pieterlexis/subscriptions","organizations_url":"https://api.github.com/users/pieterlexis/orgs","repos_url":"https://api.github.com/users/pieterlexis/repos","events_url":"https://api.github.com/users/pieterlexis/events{/privacy}","received_events_url":"https://api.github.com/users/pieterlexis/received_events","type":"User","site_admin":false},"repo":{"id":22097190,"name":"pdns","full_name":"pieterlexis/pdns","owner":{"login":"pieterlexis","id":731232,"avatar_url":"https://avatars.githubusercontent.com/u/731232?v=3","gravatar_id":"","url":"https://api.github.com/users/pieterlexis","html_url":"https://github.com/pieterlexis","followers_url":"https://api.github.com/users/pieterlexis/followers","following_url":"https://api.github.com/users/pieterlexis/following{/other_user}","gists_url":"https://api.github.com/users/pieterlexis/gists{/gist_id}","starred_url":"https://api.github.com/users/pieterlexis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pieterlexis/subscriptions","organizations_url":"https://api.github.com/users/pieterlexis/orgs","repos_url":"https://api.github.com/users/pieterlexis/repos","events_url":"https://api.github.com/users/pieterlexis/events{/privacy}","received_events_url":"https://api.github.com/users/pieterlexis/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/pieterlexis/pdns","description":"PowerDNS","fork":true,"url":"https://api.github.com/repos/pieterlexis/pdns","forks_url":"https://api.github.com/repos/pieterlexis/pdns/forks","keys_url":"https://api.github.com/repos/pieterlexis/pdns/keys{/key_id}","collaborators_url":"https://api.github.com/repos/pieterlexis/pdns/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/pieterlexis/pdns/teams","hooks_url":"https://api.github.com/repos/pieterlexis/pdns/hooks","issue_events_url":"https://api.github.com/repos/pieterlexis/pdns/issues/events{/number}","events_url":"https://api.github.com/repos/pieterlexis/pdns/events","assignees_url":"https://api.github.com/repos/pieterlexis/pdns/assignees{/user}","branches_url":"https://api.github.com/repos/pieterlexis/pdns/branches{/branch}","tags_url":"https://api.github.com/repos/pieterlexis/pdns/tags","blobs_url":"https://api.github.com/repos/pieterlexis/pdns/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/pieterlexis/pdns/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/pieterlexis/pdns/git/refs{/sha}","trees_url":"https://api.github.com/repos/pieterlexis/pdns/git/trees{/sha}","statuses_url":"https://api.github.com/repos/pieterlexis/pdns/statuses/{sha}","languages_url":"https://api.github.com/repos/pieterlexis/pdns/languages","stargazers_url":"https://api.github.com/repos/pieterlexis/pdns/stargazers","contributors_url":"https://api.github.com/repos/pieterlexis/pdns/contributors","subscribers_url":"https://api.github.com/repos/pieterlexis/pdns/subscribers","subscription_url":"https://api.github.com/repos/pieterlexis/pdns/subscription","commits_url":"https://api.github.com/repos/pieterlexis/pdns/commits{/sha}","git_commits_url":"https://api.github.com/repos/pieterlexis/pdns/git/commits{/sha}","comments_url":"https://api.github.com/repos/pieterlexis/pdns/comments{/number}","issue_comment_url":"https://api.github.com/repos/pieterlexis/pdns/issues/comments{/number}","contents_url":"https://api.github.com/repos/pieterlexis/pdns/contents/{+path}","compare_url":"https://api.github.com/repos/pieterlexis/pdns/compare/{base}...{head}","merges_url":"https://api.github.com/repos/pieterlexis/pdns/merges","archive_url":"https://api.github.com/repos/pieterlexis/pdns/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/pieterlexis/pdns/downloads","issues_url":"https://api.github.com/repos/pieterlexis/pdns/issues{/number}","pulls_url":"https://api.github.com/repos/pieterlexis/pdns/pulls{/number}","milestones_url":"https://api.github.com/repos/pieterlexis/pdns/milestones{/number}","notifications_url":"https://api.github.com/repos/pieterlexis/pdns/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/pieterlexis/pdns/labels{/name}","releases_url":"https://api.github.com/repos/pieterlexis/pdns/releases{/id}","deployments_url":"https://api.github.com/repos/pieterlexis/pdns/deployments","created_at":"2014-07-22T08:52:10Z","updated_at":"2016-02-24T14:29:33Z","pushed_at":"2016-06-03T07:52:58Z","git_url":"git://github.com/pieterlexis/pdns.git","ssh_url":"git@github.com:pieterlexis/pdns.git","clone_url":"https://github.com/pieterlexis/pdns.git","svn_url":"https://github.com/pieterlexis/pdns","homepage":null,"size":30739,"stargazers_count":0,"watchers_count":0,"language":"C++","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"PowerDNS:master","ref":"master","sha":"deffaae41f25016c0dd59badf65d6721f08a72c6","user":{"login":"PowerDNS","id":1282630,"avatar_url":"https://avatars.githubusercontent.com/u/1282630?v=3","gravatar_id":"","url":"https://api.github.com/users/PowerDNS","html_url":"https://github.com/PowerDNS","followers_url":"https://api.github.com/users/PowerDNS/followers","following_url":"https://api.github.com/users/PowerDNS/following{/other_user}","gists_url":"https://api.github.com/users/PowerDNS/gists{/gist_id}","starred_url":"https://api.github.com/users/PowerDNS/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PowerDNS/subscriptions","organizations_url":"https://api.github.com/users/PowerDNS/orgs","repos_url":"https://api.github.com/users/PowerDNS/repos","events_url":"https://api.github.com/users/PowerDNS/events{/privacy}","received_events_url":"https://api.github.com/users/PowerDNS/received_events","type":"Organization","site_admin":false},"repo":{"id":9693534,"name":"pdns","full_name":"PowerDNS/pdns","owner":{"login":"PowerDNS","id":1282630,"avatar_url":"https://avatars.githubusercontent.com/u/1282630?v=3","gravatar_id":"","url":"https://api.github.com/users/PowerDNS","html_url":"https://github.com/PowerDNS","followers_url":"https://api.github.com/users/PowerDNS/followers","following_url":"https://api.github.com/users/PowerDNS/following{/other_user}","gists_url":"https://api.github.com/users/PowerDNS/gists{/gist_id}","starred_url":"https://api.github.com/users/PowerDNS/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PowerDNS/subscriptions","organizations_url":"https://api.github.com/users/PowerDNS/orgs","repos_url":"https://api.github.com/users/PowerDNS/repos","events_url":"https://api.github.com/users/PowerDNS/events{/privacy}","received_events_url":"https://api.github.com/users/PowerDNS/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/PowerDNS/pdns","description":"PowerDNS","fork":false,"url":"https://api.github.com/repos/PowerDNS/pdns","forks_url":"https://api.github.com/repos/PowerDNS/pdns/forks","keys_url":"https://api.github.com/repos/PowerDNS/pdns/keys{/key_id}","collaborators_url":"https://api.github.com/repos/PowerDNS/pdns/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/PowerDNS/pdns/teams","hooks_url":"https://api.github.com/repos/PowerDNS/pdns/hooks","issue_events_url":"https://api.github.com/repos/PowerDNS/pdns/issues/events{/number}","events_url":"https://api.github.com/repos/PowerDNS/pdns/events","assignees_url":"https://api.github.com/repos/PowerDNS/pdns/assignees{/user}","branches_url":"https://api.github.com/repos/PowerDNS/pdns/branches{/branch}","tags_url":"https://api.github.com/repos/PowerDNS/pdns/tags","blobs_url":"https://api.github.com/repos/PowerDNS/pdns/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/PowerDNS/pdns/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/PowerDNS/pdns/git/refs{/sha}","trees_url":"https://api.github.com/repos/PowerDNS/pdns/git/trees{/sha}","statuses_url":"https://api.github.com/repos/PowerDNS/pdns/statuses/{sha}","languages_url":"https://api.github.com/repos/PowerDNS/pdns/languages","stargazers_url":"https://api.github.com/repos/PowerDNS/pdns/stargazers","contributors_url":"https://api.github.com/repos/PowerDNS/pdns/contributors","subscribers_url":"https://api.github.com/repos/PowerDNS/pdns/subscribers","subscription_url":"https://api.github.com/repos/PowerDNS/pdns/subscription","commits_url":"https://api.github.com/repos/PowerDNS/pdns/commits{/sha}","git_commits_url":"https://api.github.com/repos/PowerDNS/pdns/git/commits{/sha}","comments_url":"https://api.github.com/repos/PowerDNS/pdns/comments{/number}","issue_comment_url":"https://api.github.com/repos/PowerDNS/pdns/issues/comments{/number}","contents_url":"https://api.github.com/repos/PowerDNS/pdns/contents/{+path}","compare_url":"https://api.github.com/repos/PowerDNS/pdns/compare/{base}...{head}","merges_url":"https://api.github.com/repos/PowerDNS/pdns/merges","archive_url":"https://api.github.com/repos/PowerDNS/pdns/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/PowerDNS/pdns/downloads","issues_url":"https://api.github.com/repos/PowerDNS/pdns/issues{/number}","pulls_url":"https://api.github.com/repos/PowerDNS/pdns/pulls{/number}","milestones_url":"https://api.github.com/repos/PowerDNS/pdns/milestones{/number}","notifications_url":"https://api.github.com/repos/PowerDNS/pdns/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/PowerDNS/pdns/labels{/name}","releases_url":"https://api.github.com/repos/PowerDNS/pdns/releases{/id}","deployments_url":"https://api.github.com/repos/PowerDNS/pdns/deployments","created_at":"2013-04-26T11:16:49Z","updated_at":"2016-06-01T10:27:54Z","pushed_at":"2016-06-03T07:52:59Z","git_url":"git://github.com/PowerDNS/pdns.git","ssh_url":"git@github.com:PowerDNS/pdns.git","clone_url":"https://github.com/PowerDNS/pdns.git","svn_url":"https://github.com/PowerDNS/pdns","homepage":null,"size":39674,"stargazers_count":601,"watchers_count":601,"language":"C++","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":234,"mirror_url":null,"open_issues_count":367,"forks":234,"open_issues":367,"watchers":601,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/PowerDNS/pdns/pulls/3923"},"html":{"href":"https://github.com/PowerDNS/pdns/pull/3923"},"issue":{"href":"https://api.github.com/repos/PowerDNS/pdns/issues/3923"},"comments":{"href":"https://api.github.com/repos/PowerDNS/pdns/issues/3923/comments"},"review_comments":{"href":"https://api.github.com/repos/PowerDNS/pdns/pulls/3923/comments"},"review_comment":{"href":"https://api.github.com/repos/PowerDNS/pdns/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/PowerDNS/pdns/pulls/3923/commits"},"statuses":{"href":"https://api.github.com/repos/PowerDNS/pdns/statuses/94dcacaa73fd2aa0f4466d448083c5be6ab4351d"}}}}
{"actor":{"display_login":"Habbie"}}