From e7e9392d53462a6988cf2f6373b0052fde7c0fcb Mon Sep 17 00:00:00 2001 From: Mark Drobnak Date: Sun, 16 Sep 2018 17:10:46 -0400 Subject: [PATCH 1/3] Expand upon DNSSEC warning Now it explains that any DNSSEC-supporting resolver can be used with DNSSEC. Signed-off-by: Mark Drobnak --- settings.php | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/settings.php b/settings.php index 1b0b00da..ea87dc7f 100644 --- a/settings.php +++ b/settings.php @@ -834,8 +834,9 @@ if (isset($_GET['tab']) && in_array($_GET['tab'], array("sysadmin", "blocklists"

Validate DNS replies and cache DNSSEC data. When forwarding DNS queries, Pi-hole requests the DNSSEC records needed to validate - the replies. Use Google, Norton, DNS.WATCH or Quad9 DNS servers when activating - DNSSEC. Note that the size of your log might increase significantly + the replies. Use Google, Norton, DNS.WATCH, Quad9, or another DNS + server which supports DNSSEC when activating DNSSEC. Note that + the size of your log might increase significantly when enabling DNSSEC. A DNSSEC resolver test can be found here.

From 9743da7b9668ff7b8df70d30e6da7fcf5e37b27c Mon Sep 17 00:00:00 2001 From: Mark Drobnak Date: Mon, 17 Sep 2018 11:35:52 -0400 Subject: [PATCH 2/3] Add more DNSSEC warnings. Signed-off-by: Mark Drobnak --- settings.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/settings.php b/settings.php index ea87dc7f..248bdfc7 100644 --- a/settings.php +++ b/settings.php @@ -834,7 +834,9 @@ if (isset($_GET['tab']) && in_array($_GET['tab'], array("sysadmin", "blocklists"

Validate DNS replies and cache DNSSEC data. When forwarding DNS queries, Pi-hole requests the DNSSEC records needed to validate - the replies. Use Google, Norton, DNS.WATCH, Quad9, or another DNS + the replies. If a domain fails validation or the upstream does + support DNSSEC, this setting can cause issues resolving domains. + Use Google, Norton, DNS.WATCH, Quad9, or another DNS server which supports DNSSEC when activating DNSSEC. Note that the size of your log might increase significantly when enabling DNSSEC. A DNSSEC resolver test can be found From 400e4168e86381cb6bec7c89ea97daf505881656 Mon Sep 17 00:00:00 2001 From: Mark Drobnak Date: Mon, 17 Sep 2018 16:59:53 -0400 Subject: [PATCH 3/3] Add a missing "not" Signed-off-by: Mark Drobnak --- settings.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/settings.php b/settings.php index 248bdfc7..9faaf678 100644 --- a/settings.php +++ b/settings.php @@ -834,7 +834,7 @@ if (isset($_GET['tab']) && in_array($_GET['tab'], array("sysadmin", "blocklists"

Validate DNS replies and cache DNSSEC data. When forwarding DNS queries, Pi-hole requests the DNSSEC records needed to validate - the replies. If a domain fails validation or the upstream does + the replies. If a domain fails validation or the upstream does not support DNSSEC, this setting can cause issues resolving domains. Use Google, Norton, DNS.WATCH, Quad9, or another DNS server which supports DNSSEC when activating DNSSEC. Note that