Disable DNSSEC for specific domains?

[DL6ER]

@ardevd

Is it possible to exclude/whitelist specific domains from DNSSEC verification?

Yes, please check out

DNSSEC validation and local domains

Insecure zones can be added by specifying them together with the responsible upstream server, like: server=/my.home/192.168.0.10 which means that the zone my.home is served by 192.168.0.10. DNSSEC is disabled for this zone by default unless you provide a trust-anchor. This is possible, too. There is the config option proxy-dnssec for this. Quoting the dnsmasq man page: --proxy-dnssec Copy the DNSSEC Authenticated Data bit from upstream servers to downstream clients. This is an alternat…