enable-root-server as config option

[jschlyter]

Has there been any discussion on moving the compile time option --enable-root-server to a runtime configuration option? Where I understand why measures should be taken to protect users from using NSD as a root server, requiring a custom build seems a bit to complicated. Having this as a runtime configuration option would help a lot running of the shelf binary packages.

[k0ekk0ek]

Hi @jschlyter! You're right in that the compile-time option is there to prevent people from unknowingly serving some version of the root zone. I asked around internally and people are fine with turning this into a runtime option (it was added before NSD supported configuration files). I'll have a look to determine the amount of work involved.

[anandb-ripencc]

I would go further and say that this option should be dropped altogether. Other name servers, such as BIND, Knot DNS and PowerDNS, do not require enabling anything special to run as a root name server, and I haven't heard of any cases of folk misconfiguring things. This whole enable-root-server option, whether as a compile-time or run-time, is unnecessary.