Override DISABLE_DNSSEC when EXPERIMENTAL_DANE is in use

diff --git a/src/src/EDITME b/src/src/EDITME
index 866987c25606df724683f1cc52407879f72fc840..9b649c6cff9a548d3f86fab73786188b1d15e209 100644 (file)
--- a/src/src/EDITME
+++ b/src/src/EDITME
@@ -426,6 +426,7 @@ EXIM_MONITOR=eximon.bin
 # By default, Exim has support for checking the AD bit in a DNS response, to
 # determine if DNSSEC validation was successful.  If your system libraries
 # do not support that bit, then set DISABLE_DNSSEC to "yes"
+# Note: Enabling EXPERIMENTAL_DANE unconditionally overrides this setting.
 
 # DISABLE_DNSSEC=yes
 
@@ -492,6 +493,7 @@ EXIM_MONITOR=eximon.bin
 # EXPERIMENTAL_CERTNAMES=yes
 
 # Uncomment the following line to add DANE support
+# Note: Enabling this unconditionally overrides DISABLE_DNSSEC
 # EXPERIMENTAL_DANE=yes
 
 # Uncomment the following line to add SOCKS support

diff --git a/src/src/exim.h b/src/src/exim.h
index 48cf8c146c9757cbe227bffbbcf72c3ad9720cc1..75d14660fa8cada35e7c355e3f163f4e5ee261dd 100644 (file)
--- a/src/src/exim.h
+++ b/src/src/exim.h
@@ -591,4 +591,9 @@ default to EDQUOT if it exists, otherwise ENOSPC. */
   #endif
 #endif
 
+/* DANE w/o DNSSEC is useless */
+#if defined(EXPERIMENTAL_DANE) && defined(DISABLE_DNSSEC)
+  #undef DISABLE_DNSSEC
+#endif
+
 /* End of exim.h */