diff options
| author | Ruben Herold <ruben@puettmann.net> | 2026-09-28 11:44:19 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-09-28 10:44:19 +0100 |
| commit | ed96f4952154bff54de9c9662af879bfb385c6d7 (patch) | |
| tree | d0deb2ddc7ec8a2bb018645ed6dc277b591166f0 /docs | |
| parent | 3f1a2f8e600eebd2de93486d097d3f3b2268b016 (diff) | |
| download | vyos-documentation-ed96f4952154bff54de9c9662af879bfb385c6d7.tar.gz vyos-documentation-ed96f4952154bff54de9c9662af879bfb385c6d7.zip | |
docs: T9175: document dns forwarding options security-status-poll-domain (#2193)
* docs: T9175: document dns forwarding options security-poll-suffix
Document the new opt-in `service dns forwarding options
security-poll-suffix` setting that controls the PowerDNS recursor's
periodic security status poll, disabled by default.
* docs: T9175: fix security-poll-suffix placement and clarify disable
The security-poll-suffix cfgcmd was placed under "Per-domain
forwarding" even though it's a global forwarding option, and used the
"forwarding options" convention (bold summary + Example block) used
by ecs-add-for/ecs-ipv4-bits/edns-subnet-allow-list right above it.
Also documents how to disable polling again (delete the option),
clarifies it only takes effect with a non-empty suffix, and that
secpoll.powerdns.com is PowerDNS' own poll domain rather than a VyOS
default. Switches secpoll.powerdns.com from double to single
backticks, matching MyST inline-code convention.
Flagged by CodeRabbit and the Claude review bot on PR #2193.
* docs: T9175: rename security-poll-suffix option to security-status-poll-domain
Follows vyos-1x PR #5389 rename per dmbaturin's review: the value is a
full FQDN, not a suffix, and the poll checks for known vulnerabilities.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/configuration/service/dns.md | 27 |
1 files changed, 27 insertions, 0 deletions
diff --git a/docs/configuration/service/dns.md b/docs/configuration/service/dns.md index a18e47e6..75c01f72 100644 --- a/docs/configuration/service/dns.md +++ b/docs/configuration/service/dns.md @@ -451,6 +451,33 @@ set service dns forwarding options edns-subnet-allow-list example.com set service dns forwarding options edns-subnet-allow-list 192.0.2.0/24 ``` +```{cfgcmd} set service dns forwarding options security-status-poll-domain \<domain-name\> + +**Configure the domain used by the PowerDNS recursor to periodically +poll for known vulnerabilities in the running version.** + +Disabled by default, since VyOS ships its own patched/backported +package that is not updated in-place, making the poll result +meaningless. Only takes effect once a domain is configured; delete +the option to disable polling again. + +`secpoll.powerdns.com` is PowerDNS' own security-status poll domain, +not a VyOS default - set it explicitly to use it, or point this at a +custom domain operated by your own organization. +``` + +Example: + +```none +set service dns forwarding options security-status-poll-domain secpoll.powerdns.com +``` + +To disable polling again: + +```none +delete service dns forwarding options security-status-poll-domain +``` + ### Per-domain forwarding ```{cfgcmd} set service dns forwarding domain \<domain-name\> name-server \<address\> |