From 51db86f89801b26a517823dd9c0bb5c095b76b93 Mon Sep 17 00:00:00 2001
From: florian <>
Date: Tue, 11 Dec 2018 19:16:36 +0000
Subject: [PATCH] the world is not ready for dnssec enabled by default

---
 src/etc/unbound.conf | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/src/etc/unbound.conf b/src/etc/unbound.conf
index 942be2dc..b832efe9 100644
--- a/src/etc/unbound.conf
+++ b/src/etc/unbound.conf
@@ -1,4 +1,4 @@
-# $OpenBSD: unbound.conf,v 1.11 2018/12/10 16:46:03 sthen Exp $
+# $OpenBSD: unbound.conf,v 1.12 2018/12/11 19:16:36 florian Exp $
 
 server:
 	interface: 127.0.0.1
@@ -19,12 +19,14 @@ server:
 	hide-identity: yes
 	hide-version: yes
 
-	# Enable DNSSEC validation.
-	auto-trust-anchor-file: "/var/unbound/db/root.key"
-	val-log-level: 2
+	# Uncomment to enable DNSSEC validation.
+	#
+	#auto-trust-anchor-file: "/var/unbound/db/root.key"
 
-	# Synthesize NXDOMAINs from DNSSEC NSEC chains.  RFC 8198
-	aggressive-nsec: yes
+	# Uncomment to synthesize NXDOMAINs from DNSSEC NSEC chains
+	# https://tools.ietf.org/html/rfc8198
+	#
+	#aggressive-nsec: yes
 
 	# Serve zones authoritatively from Unbound to resolver clients.
 	# Not for external service.