DNSSEC: do top-down search for limit of secure delegation.unsigned

1 files changed, 9 insertions, 0 deletions

diff --git a/CHANGELOG b/CHANGELOG
index 2b6356b..e8bf80f 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -31,7 +31,16 @@ version 2.73
 	    request for certain domains, before the correct answer can
             arrive. Thanks to Glen Huang for the patch.
 	
+	    Revisit the part of DNSSEC validation which determines if an 
+	    unsigned answer is legit, or is in some part of the DNS 
+	    tree which should be signed. Dnsmasq now works from the 
+	    DNS root downward looking for the limit of signed 
+	    delegations, rather than working bottom up. This is 
+	    both more correct, and less likely to trip over broken 
+	    nameservers in the unsigned parts of the DNS tree 
+	    which don't respond well to DNSSEC queries.
 
+	
 version 2.72
             Add ra-advrouter mode, for RFC-3775 mobile IPv6 support.