Expire DNSSEC signatures without time skew

Fixing internetstandards#1481.
bwbroersma · Dec 5, 2024 · 0e5a6d1 · 0e5a6d1
1 parent ca80957
commit 0e5a6d1
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/docker/resolver/resolver-validating.conf.template b/docker/resolver/resolver-validating.conf.template
@@ -12,6 +12,10 @@ server:
   module-config: "validator iterator"
   chroot: ""
 
+  # expire DNSSEC signatures without time skew
+  val-sig-skew-min: 0
+  val-sig-skew-max: 0
+
   cache-max-ttl: ${DNS_CACHE_TTL}
   cache-max-negative-ttl: ${DNS_CACHE_TTL}