From 73b6fc7770556ed08477bef7e2cd05a45986356d Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Tue, 3 Nov 2020 20:07:02 +0100 Subject: [PATCH] resolved: never route DNSSEC traffic to LLMNR/mDNS LLMNR/mDNS don't support DNSSEC, hence there's no point in routing any lookups asking for DNSSEC there. This speeds up looking up DNSSEC RRs for top-level domains, since we don't have to wait for LLMNR to complete. --- src/resolve/resolved-dns-scope.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/resolve/resolved-dns-scope.c b/src/resolve/resolved-dns-scope.c index cee93a2c04..d8e4f6fee6 100644 --- a/src/resolve/resolved-dns-scope.c +++ b/src/resolve/resolved-dns-scope.c @@ -671,6 +671,10 @@ bool dns_scope_good_key(DnsScope *s, const DnsResourceKey *key) { return !dns_name_is_root(name); } + /* Never route DNSSEC RR queries to LLMNR/mDNS scopes */ + if (dns_type_is_dnssec(key->type)) + return false; + /* On mDNS and LLMNR, send A and AAAA queries only on the respective scopes */ key_family = dns_type_to_af(key->type);