<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
@font-face
{font-family:Cambria;
panose-1:2 4 5 3 5 4 6 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">I haven’t tried anything yet as I wanted to make sure I didn’t break anything.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">I can add the validation no to the zone and named-checkconf and see if it will take it. I’ll have to wait until after hours to try it.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Thanks
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Evan McKinney <evan@evanm.nyc>
<br>
<b>Sent:</b> Thursday, March 6, 2025 8:05 AM<br>
<b>To:</b> Chris Isaksen <Chris.Isaksen@nysed.gov><br>
<b>Cc:</b> bind-users@lists.isc.org<br>
<b>Subject:</b> Re: Questions about "dnssec validation" statement<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hi Chris<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">If you've got your global options set similarly to this<o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">options {<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> dnssec-validation auto; // Global validation enabled<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> // ... other options ...<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">};<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">Have you been able to try something along the lines of this?<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal">zone "no-dnssec.example" {<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> type forward;<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> forwarders { 192.0.2.1; };<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> validation no;<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">};<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">-Evan<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On 6 Mar 2025, at 07:56, Chris Isaksen <<a href="mailto:Chris.Isaksen@nysed.gov">Chris.Isaksen@nysed.gov</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">I was wondering if dnssec validation could be set to auto in the options section and then set it to ‘no’ in a particular zone?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">We would like to use “dnssec validation auto” but a few forwarding zones we have, we know do not use dnssec and queries fail if it’s not set to no.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Thanks<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Chris Isaksen<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">System Administrator<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Server Support Unit<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">(518)-473-7580<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Helvetica",sans-serif"><br style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;text-align:start;-webkit-text-stroke-width: 0px;word-spacing:0px">
<br>
</span><o:p></o:p></p>
<div style="border:dotted #003333 1.0pt;padding:10.0pt 10.0pt 10.0pt 10.0pt;caret-color: rgb(0, 0, 0);font-variant-caps: normal;text-align:start;-webkit-text-stroke-width: 0px;word-spacing:0px">
<p class="MsoNormal" style="background:#D5EAFF"><span style="font-family:"Cambria",serif;color:red">Confidentiality Notice</span><span style="font-size:10.5pt;font-family:"Helvetica",sans-serif"><o:p></o:p></span></p>
<p style="line-height:10.0pt;background:#D5EAFF"><span style="font-size:9.0pt;font-family:"Cambria",serif;color:black">This email including all attachments is confidential and intended solely for the use of the individual or entity to which it is addressed.
This communication may contain information that is protected from disclosure under State and/or Federal law. Please notify the sender immediately if you have received this communication in error and delete this email from your system. If you are not the intended
recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.<span class="apple-converted-space"> </span></span><span style="font-size:9.0pt;font-family:"Cambria",serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="background:#D5EAFF"><span style="font-size:10.5pt;font-family:"Helvetica",sans-serif"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Helvetica",sans-serif">--<span class="apple-converted-space"> </span><br>
Visit<span class="apple-converted-space"> </span></span><a href="https://lists.isc.org/mailman/listinfo/bind-users"><span style="font-size:10.5pt;font-family:"Helvetica",sans-serif">https://lists.isc.org/mailman/listinfo/bind-users</span></a><span class="apple-converted-space"><span style="font-size:10.5pt;font-family:"Helvetica",sans-serif"> </span></span><span style="font-size:10.5pt;font-family:"Helvetica",sans-serif">to
unsubscribe from this list<br>
<br>
ISC funds the development of this software with paid support subscriptions. Contact us at<span class="apple-converted-space"> </span></span><a href="https://www.isc.org/contact/"><span style="font-size:10.5pt;font-family:"Helvetica",sans-serif">https://www.isc.org/contact/</span></a><span class="apple-converted-space"><span style="font-size:10.5pt;font-family:"Helvetica",sans-serif"> </span></span><span style="font-size:10.5pt;font-family:"Helvetica",sans-serif">for
more information.<br>
<br>
<br>
bind-users mailing list<br>
</span><a href="mailto:bind-users@lists.isc.org"><span style="font-size:10.5pt;font-family:"Helvetica",sans-serif">bind-users@lists.isc.org</span></a><span style="font-size:10.5pt;font-family:"Helvetica",sans-serif"><br>
</span><a href="https://lists.isc.org/mailman/listinfo/bind-users"><span style="font-size:10.5pt;font-family:"Helvetica",sans-serif">https://lists.isc.org/mailman/listinfo/bind-users</span></a><o:p></o:p></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>