- zonemd-check: yesno option, default no, enables the processing

of ZONEMD records for that zone.

doc/Changelog

@@ -1,6 +1,8 @@
 27 May 2021: Wouter
 	- Merge #496 from banburybill: Use build system endianness if
 	  available, otherwise try to work it out.
+	- zonemd-check: yesno option, default no, enables the processing
+	  of ZONEMD records for that zone.
 
 25 May 2021: Wouter
 	- Move the NSEC3 max iterations count in line with the 150 value

doc/example.conf.in

@@ -1033,6 +1033,7 @@ remote-control:
 #	name: "example.org"
 #	for-downstream: yes
 #	for-upstream: yes
+#	zonemd-check: no
 #	zonemd-reject-absence: no
 #	zonefile: "example.org.zone"
 

doc/unbound.conf.5.in

@@ -1980,6 +1980,12 @@ to the authority servers for this zone, it'll fetch the data directly from
 the zone data.  Turn it on when you want unbound to provide recursion for
 downstream clients, and use the zone data as a local copy to speed up lookups.
 .TP
+.B zonemd\-check: \fI<yes or no>
+Enable this option to check ZONEMD records in the zone. Default is disabled.
+The ZONEMD record is a checksum over the zone data. This includes glue in
+the zone and data from the zone file, and excludes comments from the zone file.
+When there is a DNSSEC chain of trust, DNSSEC signatures are checked too.
+.TP
 .B zonemd\-reject\-absence: \fI<yes or no>
 Enable this option to reject the absence of the ZONEMD record.  Without it,
 when zonemd is not there it is not checked.  It is useful to enable for a