On 29/01/2025 16.46, Mathieu Roy via knot-resolver-users wrote:
  Is there somewhere an example of such setup, with ACL
ending up on two
 different TLS_FORWARD and one with no cache ?  
I'm not aware.  Disabling cache should still work by this hack:
https://lists.nic.cz/hyperkitty/list/knot-resolver-users@lists.nic.cz/messa…
But I suspect that our DNSSEC validator won't work well without caching,
possibly pulling the same record multiple times during a single client's
request, e.g. when encountering CNAME jumps across zones.