Josh Soref authored 3 years ago and Daniel Salzman committed 3 years ago

Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>

Libor Peltan authored 3 years ago and Daniel Salzman committed 3 years ago

... this removes the need for equal configuration of offline ksk sides

David Vasek authored 3 years ago and Daniel Salzman committed 3 years ago

It is a frequently asked question from users.

David Vasek authored 3 years ago and Daniel Salzman committed 3 years ago

Update the web link to ITU-T X.690 Recommendation (DER key format),
the previous standard revision has been superseded. Fix a critical typo.

Functional changes:

1. Zone files are stored in a dedicated directory.
2. Zone files use the zones' default file names in the backup,
   not the file names defined in the configuration as before. This
   change eleminates file name conflicts which were possible with the
   original backup design.

Iff there isn't a label file and the force flag is set, use the original backup
format for restore.

Otherwise report a backup without a label file as malformed.

If there is an empty label file, the label file doesn't start with a label file
header, the label file doesn't include a backup format description, or the backup
format code isn't known, consider it a malformed backup and don't restore from it,
even if the force flag has been set.

The "-f" parameter for zone-restore allows restore from older backups
which have been created without a backup label file.

The label file identifies the backup an prevents another backup to be made
to an already existing backup. Existence of a label file is necessary for a restore,
which helps to prevent a frequent user error and to avoid a number of failures
which would be triggered by it.

In addition to that, every label file contains a brief description
of the backup and its parameters. A list of zones that the backup contains
isn't included so far.

Libor Peltan authored 3 years ago and Daniel Salzman committed 3 years ago

...automatic KSK roll must ensure that new KSK has been signing
the DNSKEY for dnskey-ttl seconds before submission updates DS

David Vasek authored 4 years ago and Daniel Salzman committed 4 years ago

As per RFC 8499, section 6.
https://tools.ietf.org/html/rfc8499#section-6

David Vasek authored 4 years ago and Daniel Salzman committed 4 years ago

The rule for Knot DNS documentation is:
- verb is "back up"
- noun and adjective are "backup".

David Vasek authored 4 years ago and Daniel Salzman committed 4 years ago

Point out that the XDP mode is only available on Linux OS's.

Libor Peltan authored 4 years ago and Daniel Salzman committed 4 years ago

...only for manual key management