diff options
| author |  cricketliu <cricket@infoblox.com>
| 2018-01-10 23:31:34 -0800 |
|---|---|---|
| committer |  Miek Gieben <miek@miek.nl>
| 2018-01-11 07:31:34 +0000 |
| commit | 655231a5993d017758e6af91c7d2fcaac7823fe5 (patch) | |
| tree | 8be6f615d5472026b6685943fd4ac82d23a78a84 /plugin/dnssec | |
| parent | d15746596f9325287ac675f8bbead6988e50a99c (diff) | |
| download | coredns-655231a5993d017758e6af91c7d2fcaac7823fe5.tar.gz coredns-655231a5993d017758e6af91c7d2fcaac7823fe5.tar.zst coredns-655231a5993d017758e6af91c7d2fcaac7823fe5.zip | |
Update README.md (#1374)
Fixing a couple of small textual problems.
Diffstat (limited to 'plugin/dnssec')
| -rw-r--r-- | plugin/dnssec/README.md | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/plugin/dnssec/README.md b/plugin/dnssec/README.md index 904fb9269..b94e14ec1 100644 --- a/plugin/dnssec/README.md +++ b/plugin/dnssec/README.md @@ -6,7 +6,7 @@ ## Description -With *dnssec* any reply that doesn't (or can't) do DNSSEC will get signed on-the-fly. Authenticated +With *dnssec* any reply that doesn't (or can't) do DNSSEC will get signed on the fly. Authenticated denial of existence is implemented with NSEC black lies. Using ECDSA as an algorithm is preferred as this leads to smaller signatures (compared to RSA). NSEC3 is *not* supported. @@ -19,7 +19,7 @@ dnssec [ZONES... ] { } ~~~ -The specified key is used for all signing operations. The DNSSEC signing will treat this key a +The specified key is used for all signing operations. The DNSSEC signing will treat this key as a CSK (common signing key), forgoing the ZSK/KSK split. All signing operations are done online. Authenticated denial of existence is implemented with NSEC black lies. Using ECDSA as an algorithm is preferred as this leads to smaller signatures (compared to RSA). NSEC3 is *not* supported. @@ -33,7 +33,7 @@ used (See [bugs](#bugs)). * `key file` indicates that **KEY** file(s) should be read from disk. When multiple keys are specified, RRsets will be signed with all keys. Generating a key can be done with `dnssec-keygen`: `dnssec-keygen -a ECDSAP256SHA256 <zonename>`. A key created for zone *A* can be safely used for zone *B*. The name of the - key file can be specified as one of the following formats + key file can be specified in one of the following formats * basename of the generated key `Kexample.org+013+45330` * generated public key `Kexample.org+013+45330.key` |