RE: How See what is Cached?

2009-07-14 Thread Alans
You should create the file that specified in Options: options { directory "/var/named"; dump-file "/data/cache_dump.db"; make sure that cache_dump.db file exist in that directory and if it is Chroot then it will be inside Chroot directory, also make sure that named has proper perm

Re: Inconsistent results for domains following cache flushes

2009-07-14 Thread Mark Andrews
They have bad delegations, the parent and child zones don't match. The nameservers listed in the parent zone refer to CNAMEs. Replacing the CNAMEs by address records or updating the delegations will fix this. Mark ns4.danielbeard.com.86400 IN CNAME ns.danielbeard.com. ns3.danielbea

Inconsistent results for domains following cache flushes

2009-07-14 Thread Nick Jones
We are seeing weird issues with customers domains: www.andra.com.au and www.wsid.com.au Flushing the cache then doing a lookup for one then the other, often one will succeed and the other will fail. [NBRS-3.0 myhost named]# host www.andra.com.au www.andra.com.au is an alias for andra.com.au. andr

Re: Adding first DNSKEY record with update (9.6.0 vs 9.6.1)

2009-07-14 Thread Mark Andrews
In message , Chris Thompson writes: > In BIND 9.6.0 one could take an unsigned zone and add an initial > KSK and ZSK to it using nsupdate (and if the right files were in the > key directory, it would sign everything correctly). In BIND 9.6.1 > this no longer works: it returns REFUSED. It's unclea

Re: DNSSEC-deployment

2009-07-14 Thread Chris Buxton
On Jun 30, 2009, at 8:35 AM, Mohammed Ejaz wrote: Hi, Since we are one of the leading ISP and Domain service provider in the KSA,, in our DNS we have about 1000 domains are hosted, Now actually my concern is regarding the DNSSEC deployment, Since I went through with several articles, stat

Re: Bind 9.6.1: skipping zone transfer, but why ?

2009-07-14 Thread Chris Buxton
On Jun 30, 2009, at 6:15 AM, bind9 wrote: 1) "skipping zone transfer as master 213.173.250.146#53 (source 0.0.0.0#0) is unreachable (cached)" seem to indicate that the slave has cached a knowledge about the master being unreachable. It isn't. I can nslookup on the master from the slave just

Re: rDNS Round-Robin

2009-07-14 Thread Bryan Irvine
On Wed, Jul 8, 2009 at 5:08 PM, Mark Andrews wrote: > > In message <53d706300907081412r191946eeo5c9a66657bf8e...@mail.gmail.com>, > Bryan >  Irvine writes: >> On Mon, Jul 6, 2009 at 4:08 PM, Kevin Darcy wrote: >> > Bryan Irvine wrote: >> >> >> >> Other than to really annoy me; =A0is there a valid

Re: DNSKEY Validation

2009-07-14 Thread Mark Elkins
On Tue, 2009-07-14 at 17:50 +1000, Mark Andrews wrote: > In message <1247555725.13064.4.ca...@ilinux>, Mark Elkins writes: > > OK - so I accept that the algorithm will change. > > > > What about some sort of validation of the base-64 part of the key? > > Is there a checksum byte/word? > > Is there

clearing local caches

2009-07-14 Thread Scott Haneda
Hello, this may not entirely be related to BIND/named, though I believe it is. I am working on a set of benchmarks to test the resolving speed of different recursive DNS providers. My plan is call an http resource, and see how long it takes to resolve that host, as well as all embedded h

Adding first DNSKEY record with update (9.6.0 vs 9.6.1)

2009-07-14 Thread Chris Thompson
In BIND 9.6.0 one could take an unsigned zone and add an initial KSK and ZSK to it using nsupdate (and if the right files were in the key directory, it would sign everything correctly). In BIND 9.6.1 this no longer works: it returns REFUSED. It's unclear to me whether this change was intended - if

RE: Odd PTR through cisco NAT behaviour.

2009-07-14 Thread Jason Mitchell
I think perhaps Cisco IOS does (from the IOS online help for ip nat ): "no-payload" - "No translation of embedded address/port in the payload" Cheers, Jason -Original Message- From: bind-users-boun...@lists.isc.org [mailto:bind-users-boun...@lists.isc.org] On Behalf Of Mark Andrews Se

RE: Odd PTR through cisco NAT behaviour.

2009-07-14 Thread Jason Mitchell
I think perhaps Cisco IOS does (from the IOS online help for ip nat ): "no-payload" - "No translation of embedded address/port in the payload" Cheers, Jason -Original Message- From: bind-users-boun...@lists.isc.org [mailto:bind-users-boun...@lists.isc.org] On Behalf Of Mark Andrews Se

Re: DNSKEY Validation

2009-07-14 Thread Mark Andrews
In message <1247555725.13064.4.ca...@ilinux>, Mark Elkins writes: > OK - so I accept that the algorithm will change. > > What about some sort of validation of the base-64 part of the key? > Is there a checksum byte/word? > Is there a way of checking that the length is correct? Have you thought o

Re: DNSKEY Validation

2009-07-14 Thread Mark Elkins
OK - so I accept that the algorithm will change. What about some sort of validation of the base-64 part of the key? Is there a checksum byte/word? Is there a way of checking that the length is correct? On Tue, 2009-07-14 at 10:56 +1000, Mark Andrews wrote: > In message <4a5b1bdc.3090...@gis.net>,