Deprecation notice for NSEC3 salt

[Matthijs Mekking]

Hi,

You are right, I meant "nsec3param salt-length".

On 10/8/26 11:34, pgnd wrote:
>> Thus, I am notifying you that we intend to end support for the "nsec3 
>> salt-length" (inside dnssec-policy) option in named. Our plan is to 
>> mark them as deprecated in BIND 9.20, and remove them completely as of 
>> BIND 9.22.
> 
> @ https://bind9.readthedocs.io/en/latest/dnssec-guide.html#advanced- 
> discussions-nsec3-salt
> 
> there's no reference to a literal "nsec3 salt-length"
> 
> rather, usage in policy of "nsec3param ..."
> 
>    nsec3param iterations 0 optout no salt-length 0;
> 
> just to confirm, the removal will then require
> 
> -  nsec3param iterations 0 optout no salt-length 0;
> +  nsec3param iterations 0 optout no;
> 
> ?

Yes,

> with the salt-length hardwired == 0?

And yes.