-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 07/12/2013 11:23 AM, Sam Wilson wrote:
> In article
> <mailman.736.1372773195.20661.bind-us...@lists.isc.org>, Steven
> Carr <sjc...@gmail.com> wrote:
>
>> On 2 July 2013 14:42, Sam Wilson <sam.wil...@ed.ac.uk> wrote:
>>> Can anyone here give examples of the types of various software
>>> that will not operate without a PTR record?
>>
>> There have already been numerous listings of software that
>> require reverse lookups. SMTP being the main one. Other services
>> like IRC and some databases (Oracle/MySQL) can also be configured
>> to require properly working reverse lookups.
>
> "... can also be configured ..." - see below.
>
>>> I agree that if PTR records exist then they should match an A
>>> record. My experience (and IIRC correctly the word of several
>>> RFCs) is that PTRs are not required for most things to work.
>>
>> RFC1912 [http://tools.ietf.org/html/rfc1912] section 2.1...
>>
>> Every Internet-reachable host should have a name... Make sure
>> your PTR and A records match. For every IP address, there should
>> be a matching PTR record in the in-addr.arpa domain. If a host
>> is multi-homed, (more than one IP address) make sure that all IP
>> addresses have a corresponding PTR record (not just the first
>> one). Failure to have matching PTR and A records can cause loss
>> of Internet services similar to not being registered in the DNS
>> at all. Also, PTR records must point back to a valid A record,
>> not a alias defined by a CNAME.
>
> Sorry for the delay in returning to this. RFC 1912 says:
>
> Status of this Memo
>
> This memo provides information for the Internet community. This
> memo does not specify an Internet standard of any kind. ...
>
> To make myself clear, I'm a big fan of correct PTR records and we
> try to make sure that our reverse DNS is fully populated. I do not
> regard lack of a valid PTR record to be a reason to refuse
> connection except, perhaps, in very particular circumstances, for
> instance where it might be part of a trust stance. That would be
> by agreement between consenting adults, not the law of Internetland
> in general.
Came across another instance where it may matter: TCP Wrappers.
Although the case there was a bit more peculiar -- rr.net does not
appear to have FORWARD DNS for at least some of its dynamic address
space. So you can get a PTR, and then address validation fails on the
forward address. I guess perhaps if you had no PTR it would never go
that far.
- --
____*Note: UMDNJ is now Rutgers-Biomedical and Health Sciences*
|| \\UTGERS |---------------------*O*---------------------
||_// Biomedical | Ryan Novosielski - Sr. Systems Programmer
|| \\ and Health | novos...@rutgers.edu - 973/972.0922 (2x0922)
|| \\ Sciences | OIT/EI-Academic Svcs. - ADMC 450, Newark
`'
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with undefined - http://www.enigmail.net/
iEYEARECAAYFAlHgIxoACgkQmb+gadEcsb4E7ACgzTQeo6E2lLrzu5ld7DhWWYq8
9VAAoKpte8yzfY/aXQIEsvlOLDfKv7qz
=Dk3L
-----END PGP SIGNATURE-----
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
