1581. [func] Disable DNSSEC support by default. To enable
DNSSEC specify "enable-dnssec yes;" in named.conf.
1565. [bug] CD flag should be copied to outgoing queries unless
the query is under a secure entry point in which case
CD should be set.
1558. [func] New DNSSEC 'disable-algorithms'. Support entry into
child zones for which we don't have a supported
algorithm. Such child zones are treated as unsigned.
1557. [func] Implement missing DNSSEC tests for
* NOQNAME proof with wildcard answers.
* NOWILDARD proof with NXDOMAIN.
Cache and return NOQNAME with wildcard answers.
1541. [func] NSEC now uses new bitmap format.
1519. [bug] dnssec-signzone:nsec_setbit() computed the wrong
length of the new bitmap.
1516. [func] Roll the DNSSEC types to RRSIG, NSEC and DNSKEY.
Generating a response when the qname matches a wildcard and the type
doesn't exist didn't work; the NXT name was improperly expanded and the
wildcard proof was omitted.
detach from quota in an error case. I don't know if this is strictly needed,
but it makes sense. It is probably done later as well, but all places
check for the pointer != NULL, so we'll be ok.
DNSSEC wildcard negative proof responses were longer than necessary in
some cases; the existence of a node for which the qname is a subdomain
obscures all shallower wildcards.
That is, query for y.x.foo.com. If the response contains an NXT
at x.foo.com, it's not necessary to prove that there's no wildcard at
*.foo.com, since it wouldn't be matched anyway.
Check return values or cast them to (void), as required by the coding
standards; add exceptions to the coding standards for cases where this is
not desirable
the total number of of recursive lookups being
processed exceeds max-recursive-clients, even
if some of the lookups are internally generated.
[RT #1915, #1938]
Removed all code within #ifdef DNS_OPT_NEWCODES*.
It was the last thing being sanitized out of releases; removing
it makes it possible to eliminate the sanitation process.
only binds the rdataset when returning ISC_R_SUCCESS, because that's not the case -
for example, if the root hints are '. 300 IN CNAME .', DNS_R_CNAME is returned and
the rdataset is bound
