freeipa

#8349 bind-9.16 and dnssec-enable
Closed: fixed by cheimes. Opened by slev.

Closed: fixed
Reopen Issue 
/etc/named.conf:21: option 'dnssec-enable' is obsolete and should be removed

https://downloads.isc.org/isc/bind9/9.16.0/RELEASE-NOTES-bind-9.16.0.html :

Removed Features
    The dnssec-enable option has been obsoleted and no longer has any effect. DNSSEC responses are always enabled if signatures and other DNSSEC data are present. [GL #866]

IPA code for BIND sets this option on install/upgrade.
After switching to bind-9.16 the option can be safely removed and the code should be adopted to remove no longer used one.

@cheimes could you please add this to your https://github.com/freeipa/freeipa/pull/4715/files pull request?

Metadata Update from @cheimes:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/4715
- Issue assigned to cheimes
- Issue priority set to: important
- Issue set to the milestone: FreeIPA 4.8.7

We can safely remove the option, the defaults are:

    dnssec-enable yes;\n\
    dnssec-validation yes; \n"

https://github.com/isc-projects/bind9/blob/v9_11_1/bin/named/config.c#L169-L170

I created a new PR https://github.com/freeipa/freeipa/pull/4745. The other PR is already loading too much changes into one change set.

Metadata Update from @cheimes:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/4745 (was: https://github.com/freeipa/freeipa/pull/4715)

master:

  • f5964b71572579acad9d1731b62eb3c088358c6f Remove obsolete BIND named.conf options

ipa-4-8:

  • 91f94612f3021a631dd8a97d08a6327c98f6e689 Remove obsolete BIND named.conf options

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Low
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.