The System.Xml.Schema.XmlSchemaValidationFlags.ProcessInlineSchema and System.Xml.Schema.XmlSchemaValidationFlags.ProcessSchemaLocation validation flags of an System.Xml.XmlReaderSettings object are not set by default. When these flags are set, the XmlReaderSettings.XmlResolver of the System.Xml.XmlReaderSettings object is used to resolve schema locations encountered in the instance document in the System.Xml.XmlReader. If the XmlReaderSettings.XmlResolver object is null, schema locations are not resolved even if the System.Xml.Schema.XmlSchemaValidationFlags.ProcessInlineSchema and System.Xml.Schema.XmlSchemaValidationFlags.ProcessSchemaLocation validation flags are set.

Schemas added during validation add new types and can change the validation outcome of the document being validated. As a result, external schemas should only be resolved from trusted sources.

Disabling the System.Xml.Schema.XmlSchemaValidationFlags.ProcessIdentityConstraints flag (enabled by default) is recommended when validating, untrusted, large XML documents in high availability scenarios against a schema with identity constraints over a large part of the document.