···

       
66
       
 
       
    };

     

       
67
       
 
       


     

       
68
       
 
       
    services.resolved.dnssec = mkOption {

     

       
69
       
-
       
      default = "allow-downgrade";

     

       
70
       
 
       
      example = "true";

     

       
71
       
 
       
      type = types.enum [ "true" "allow-downgrade" "false" ];

     

       
72
       
 
       
      description = lib.mdDoc ''

     
···

       
85
       
 
       
            synthesizing a DNS response that suggests DNSSEC was not

     

       
86
       
 
       
            supported.

     

       
87
       
 
       
        - `"false"`: DNS lookups are not DNSSEC validated.

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
88
       
 
       
      '';

     

       
89
       
 
       
    };

     

       
90
       
 
       


     

···

       
66
       
 
       
    };

     

       
67
       
 
       


     

       
68
       
 
       
    services.resolved.dnssec = mkOption {

     

       
69
       
+
       
      default = "false";

     

       
70
       
 
       
      example = "true";

     

       
71
       
 
       
      type = types.enum [ "true" "allow-downgrade" "false" ];

     

       
72
       
 
       
      description = lib.mdDoc ''

     
···

       
85
       
 
       
            synthesizing a DNS response that suggests DNSSEC was not

     

       
86
       
 
       
            supported.

     

       
87
       
 
       
        - `"false"`: DNS lookups are not DNSSEC validated.

     

       
88
       
+
       


     

       
89
       
+
       
        At the time of September 2023, systemd upstream advise

     

       
90
       
+
       
        to disable DNSSEC by default as the current code

     

       
91
       
+
       
        is not robust enough to deal with "in the wild" non-compliant

     

       
92
       
+
       
        servers, which will usually give you a broken bad experience

     

       
93
       
+
       
        in addition of insecure.

     

       
94
       
 
       
      '';

     

       
95
       
 
       
    };

     

       
96