Re: Are the TYPE65535 RRs necessary?

2009-05-18 Thread Mark Andrews
In message <200905182258.n4imwd7k079...@drugs.dv.isc.org>, Mark Andrews writes: > > In message , Chris T > ho > mpson writes: > > If you add DNSKEY records dynamically to a zone, BIND 9.6 signs the > > zone (provided the private keys are available) and it also creates > > TYPE65535 records at the

Re: Are the TYPE65535 RRs necessary?

2009-05-18 Thread Mark Andrews
In message , Chris Tho mpson writes: > If you add DNSKEY records dynamically to a zone, BIND 9.6 signs the > zone (provided the private keys are available) and it also creates > TYPE65535 records at the zone apex (one for each key). I had assumed > that these were necessary in some way for subsequ

Re: dig info

2009-05-18 Thread Kevin Darcy
Tech W. wrote: --- On Mon, 18/5/09, Mark Andrews wrote: From: Mark Andrews Subject: Re: dig info To: "Tech W." Cc: bind-users@lists.isc.org Received: Monday, 18 May, 2009, 10:35 PM In message <980168.77226...@web15605.mail.cnb.yahoo.com>, "Tech W." writes: Sometime I dig a domain

Re: Are the TYPE65535 RRs necessary?

2009-05-18 Thread Evan Hunt
> They indicate that the zone is in a transition state, such as being > signed by a new key or having signatures from a deleted key removed. > > This should probably be documented better, but since that record is > only for named's internal record-keeping (it ensures that the signing > process can

Re: Are the TYPE65535 RRs necessary?

2009-05-18 Thread Evan Hunt
> So what are the TYPE65535 records actually for? They indicate that the zone is in a transition state, such as being signed by a new key or having signatures from a deleted key removed. This should probably be documented better, but since that record is only for named's internal record-keeping (

Are the TYPE65535 RRs necessary?

2009-05-18 Thread Chris Thompson
If you add DNSKEY records dynamically to a zone, BIND 9.6 signs the zone (provided the private keys are available) and it also creates TYPE65535 records at the zone apex (one for each key). I had assumed that these were necessary in some way for subsequent RRSIG refreshing, etc. But ... With BIND

Re: dig info

2009-05-18 Thread Tech W.
--- On Mon, 18/5/09, Mark Andrews wrote: > From: Mark Andrews > Subject: Re: dig info > To: "Tech W." > Cc: bind-users@lists.isc.org > Received: Monday, 18 May, 2009, 10:35 PM > > In message <980168.77226...@web15605.mail.cnb.yahoo.com>, > "Tech W." writes: > > > > Sometime I dig a domain

Re: dig info

2009-05-18 Thread Mark Andrews
In message <980168.77226...@web15605.mail.cnb.yahoo.com>, "Tech W." writes: > > Sometime I dig a domain name, it returns the results below: > > ;; reply from unexpected source: 59.42.52.246#59721, expected 211.66.80.167#5 > 3 > ;; reply from unexpected source: 59.42.52.246#59721, expected 211.66

Re: Odd config problem

2009-05-18 Thread Mark Andrews
In message <61d78605-0cb2-485e-aa75-a49ba3c45...@vallden.com>, Hans Vallden wri tes: > Hello all, > > I use the secure BIND template by Rob Thomas (http://www.cymru.com/Documents/ > secure-bind-template.html > ). I have had a peculiar problem with this template conf, which I have > not been ab

Odd config problem

2009-05-18 Thread Hans Vallden
Hello all, I use the secure BIND template by Rob Thomas (http://www.cymru.com/Documents/secure-bind-template.html ). I have had a peculiar problem with this template conf, which I have not been able to resolve. My problem is that some slave zones return REFUSED when queried from the external

Re: named reloading

2009-05-18 Thread Tech W.
I tried to test it, steps as below: (1) add a zone "x.test.com", and assign an A record into it: ns.x.test.com.60 IN A192.168.1.246 (2) to reload bind every 1 second, using a shell script: #!/bin/sh while [ 1 ];do /usr/local/bind/sbin/rndc reload sleep 1 done (3) to

named reloading

2009-05-18 Thread Tech W.
Hello, Just asked this question again, b/c it's not easy to test... When named is reloading with 'rndc reload' command, client's query is coming in, what will be happened? Will client's request be dropped? Thanks. Need a Holiday? Win a $10,000 Holiday of your choice. Enter now.http://u

dig info

2009-05-18 Thread Tech W.
Sometime I dig a domain name, it returns the results below: ;; reply from unexpected source: 59.42.52.246#59721, expected 211.66.80.167#53 ;; reply from unexpected source: 59.42.52.246#59721, expected 211.66.80.167#53 ;; reply from unexpected source: 59.42.52.246#59721, expected 211.66.80.167#53