Since version 4.0, DNSSEC validation is enabled by default. This is secure default and should not be changed unless absolutely necessary.

Options in this section are intended only for expert users and normally should not be needed.

If you really need to turn DNSSEC off and are okay with lowering security of your system by doing so, add the following snippet to your configuration file.

-- turns off DNSSEC validation
trust_anchors.remove('.').

Hello Team,

I would like to know if the "DNSSEC validation failure logging" is enabled by DEFAULT in version 4.2.0. on Centos 7.

I do not have any explicit call for this module - as is described in the documentation like this: modules.load('bogus_log'), nevertheless, I´m facing a huge report in the system log regarding DNSSEC validation failure somedomainname. DNSKEY

In the configuration, I´m using the 'http' module and module 'stats', can it be relevant?

kresd.conf

-- Load Useful modules

modules = {

        'policy',   -- Block queries to local zones/bad sites

        'view',     -- Handle requests by source IP

        'stats',    -- Track internal statistics

        'hints',    -- Add static records to resolver

}

-- load HTTP module with defaults (self-signed TLS cert)

modules.load('http')

http.config()

How can I disable DNSSEC validation failure logging?

best regards,
--
Smil Milan Jeskyňka Kazatel