So far so good, this is the current version of /etc/knot-resolver/kresd.conf
-- vim:syntax=lua:set ts=4 sw=4:
-- Refer to manual: http://knot-resolver.readthedocs.org/en/stable/daemon.html#configuration
-- Network interface configuration: see kresd.systemd(7)
-- For DNS-over-HTTPS and web management when using http module
-- modules.load('http')
-- http.config({
-- cert = '/etc/knot-resolver/mycert.crt',
-- key = '/etc/knot-resolver/mykey.key',
-- tls = true,
-- })
-- To disable DNSSEC validation, uncomment the following line (not recommended)
-- trust_anchors.remove('.')
-- Load useful modules
modules = {
'hints > iterate', -- Load /etc/hosts and allow custom root hints
'stats', -- Track internal statistics
'predict', -- Prefetch expiring/frequent records
}
-- Cache size
cache.size = 100 * MB
modules.load('prefill')
prefill.config({
['.'] = {
url = 'https://www.internic.net/domain/root.zone',
ca_file = '/etc/ssl/certs/ca-certificates.crt',
interval = 86400 -- seconds
}
})
hints.root_file = '/usr/share/dns/root.hints'
hints.root({
['i.root-servers.net.'] = { '2001:7fe::53', '192.36.148.17' }
})
trust_anchors.add_file('/usr/share/dns/root.key')
The entries in syslog, when started:
May 11 12:42:09 raspberrypi systemd[1]: Starting Knot Resolver daemon...
May 11 12:42:09 raspberrypi kresd[16606]: [ ta ] warning: overriding previously set trust anchors for .
May 11 12:42:09 raspberrypi systemd[1]: Started Knot Resolver daemon.
May 11 12:42:09 raspberrypi kresd[16606]: [prefill] root zone file valid for 09 hours 40 minutes, reusing data from disk
May 11 12:42:10 raspberrypi kresd[16606]: [prefill] root zone successfully parsed, import started
May 11 12:42:10 raspberrypi kresd[16606]: [prefill] root zone refresh in 09 hours 40 minutes
May 11 12:42:10 raspberrypi kresd[16606]: [ta_update] refreshing TA for .
May 11 12:42:12 raspberrypi kresd[16606]: [ta_update] key: 20326 state: Valid
May 11 12:42:12 raspberrypi kresd[16606]: [ta_update] next refresh for . in 12 hours
NOT sure what the warning means...