From ed96f4952154bff54de9c9662af879bfb385c6d7 Mon Sep 17 00:00:00 2001 From: Ruben Herold Date: Mon, 28 Sep 2026 11:44:19 +0200 Subject: docs: T9175: document dns forwarding options security-status-poll-domain (#2193) * docs: T9175: document dns forwarding options security-poll-suffix Document the new opt-in `service dns forwarding options security-poll-suffix` setting that controls the PowerDNS recursor's periodic security status poll, disabled by default. * docs: T9175: fix security-poll-suffix placement and clarify disable The security-poll-suffix cfgcmd was placed under "Per-domain forwarding" even though it's a global forwarding option, and used the "forwarding options" convention (bold summary + Example block) used by ecs-add-for/ecs-ipv4-bits/edns-subnet-allow-list right above it. Also documents how to disable polling again (delete the option), clarifies it only takes effect with a non-empty suffix, and that secpoll.powerdns.com is PowerDNS' own poll domain rather than a VyOS default. Switches secpoll.powerdns.com from double to single backticks, matching MyST inline-code convention. Flagged by CodeRabbit and the Claude review bot on PR #2193. * docs: T9175: rename security-poll-suffix option to security-status-poll-domain Follows vyos-1x PR #5389 rename per dmbaturin's review: the value is a full FQDN, not a suffix, and the poll checks for known vulnerabilities. --- docs/configuration/service/dns.md | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) (limited to 'docs') diff --git a/docs/configuration/service/dns.md b/docs/configuration/service/dns.md index a18e47e6..75c01f72 100644 --- a/docs/configuration/service/dns.md +++ b/docs/configuration/service/dns.md @@ -451,6 +451,33 @@ set service dns forwarding options edns-subnet-allow-list example.com set service dns forwarding options edns-subnet-allow-list 192.0.2.0/24 ``` +```{cfgcmd} set service dns forwarding options security-status-poll-domain \ + +**Configure the domain used by the PowerDNS recursor to periodically +poll for known vulnerabilities in the running version.** + +Disabled by default, since VyOS ships its own patched/backported +package that is not updated in-place, making the poll result +meaningless. Only takes effect once a domain is configured; delete +the option to disable polling again. + +`secpoll.powerdns.com` is PowerDNS' own security-status poll domain, +not a VyOS default - set it explicitly to use it, or point this at a +custom domain operated by your own organization. +``` + +Example: + +```none +set service dns forwarding options security-status-poll-domain secpoll.powerdns.com +``` + +To disable polling again: + +```none +delete service dns forwarding options security-status-poll-domain +``` + ### Per-domain forwarding ```{cfgcmd} set service dns forwarding domain \ name-server \ -- cgit v1.2.3