Unable to resolv 1 domain
wouter at nlnetlabs.nl
Mon Apr 10 13:22:35 UTC 2017
On 10/04/17 15:18, Ondřej Surý wrote:
> Perhaps this could be added to things controlled by:
> harden-algo-downgrade: yes/no?
> I don't think there's any security risk from using SHA1 for DS record
> verification even if SHA-2 is available.
I never analysed the implications, but just implemented the RFC. That
is why I am surprised by this.
And I think you are right and that stuff can be controlled by the same
switch. More leniency and strictness choice.
Best regards, Wouter
> Ultimately, it's your call and decision.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 819 bytes
Desc: OpenPGP digital signature
More information about the Unbound-users