Commit fc79a7496d for bind

commit fc79a7496d5061c6efca7ef387d964395a50b659
Merge: 81434508a9 525679f60f
Author: Evan Hunt <each@isc.org>
Date:   Thu Oct 22 20:54:21 2026 +0000

    new: usr: Support for authoritative DELEG

    Implement authoritative support for extensible DNS delegation records (DELEG), based on the draft in progress at https://ietf-wg-deleg.github.io/draft-ietf-deleg-base/draft-ietf-deleg.html.

    DELEG is assigned to type 61440, DELEGPARAM to 54.

    If a zone contains a DELEG referral, it will be used to answer clients if they signal their understanding of DELEG records by setting the DE (DELEG OK) flag in queries. `dig +deflag` (or `+de` for short) can use used to set the flag on queries.

    The DELEG specification relaxes the requirement that all zones must have an NS RRset at the apex, so this is no longer enforced by default in `named`. A new `check-ns` option has been added to `named.conf` which can be used to control this: the allowed values are `fail`, `warn` and `ignore`, and the default is `warn`. Missing NS records are also no longer fatal in `named-checkzone`, but `-n fail` will restore the old behavior.

    A new flag has been added to DNSKEY records: Authoritative Delegation Types (ADT). If this flag is set for any key in the DNSKEY RRset, it indicates to a validator that this server implements authoritative DELEG: if a referral response that does not contain a DELEG record, it _will_ contain a cryptographic proof that the DELEG record does not exist. If no ADT-flagged keys are present when signing a zone that contains DELEG, a warning will be logged. Before any DELEG records are added to a zone, an ADT key should be added to the zone, and all authoritative servers for the zone must support DELEG.

    Note:  This branch does not implement recursive support for DELEG. The resolver does not set the DE flag when sending iterative queries, and DELEG-based referrals are not processed. This will be added in later work.

    Merge branch 'each-deleg-auth' into 'main'

    See merge request isc-projects/bind9!10995