Re: puzzling answer of dig with +sigchase/NSEC3

2009-11-09 Thread Evan Hunt
On Mon, Nov 09, 2009 at 04:47:02PM +0100, Klaus Malorny wrote: > I would have expected to get a "SUCCESS" also, i.e. that the negative > answer could have been validated so far. Did I miss anything? For zones > using NSEC, like "se", this seems to work. Is there no full support for > NSEC3 in d

Re: All domain data files of slave DNS synchronized every day, regardless of whether there are changes to the domain

2009-11-09 Thread Kevin Darcy
Define "synchronized". Are the *contents* of the zone files changing? Or just the timestamps? - Kevin 万善义 wrote: All domain data files of slave DNS synchronized every day, regardless of whether there are changes to the domain *Master: *options { directory "/var/named"; // query-source addres

puzzling answer of dig with +sigchase/NSEC3

2009-11-09 Thread Klaus Malorny
Hi, I am playing around with a signed zone which uses NSEC3. If I try to verify a non-existing name or a non-existing type with the "sigchase" option, I get the strange error: ;; Impossible to verify the Non-existence, the NSEC RRset can't be validated: FAILED I then checked it with the "o

Re: All domain data files of slave DNS synchronized every day, regardless of whether there are changes to the domain

2009-11-09 Thread Mark Andrews
In message <200911091650088052...@114.com.cn>, "=?gb2312?B?zfLJxtLl?=" writes: > > All domain data files of slave DNS synchronized every day, regardless of > whether there are changes to the domain What is your evidence? Note: file time stamps do NOT indicate that a transfer has occured. Named

All domain data files of slave DNS synchronized every day, regardless of whether there are changes to the domain

2009-11-09 Thread 万善义
All domain data files of slave DNS synchronized every day, regardless of whether there are changes to the domain Master: options { directory "/var/named"; // query-source address * port 53; allow-transfer { slaveip; }; allow-query { any; }; allow-query-ca