Re: DNSSEC Bogus NXDOMAIN survives authenticating RR

2009-12-08 Thread Hauke Lampe
Niobos wrote: > As soon as I activate DLV (besides the manual SEP I entered), the "removed" > behaviour changes: > * First lookup still returns SERVFAIL > * Subsequent lookups now return NXDOMAIN with the AD flag *set*! (log > confirms that my domain is not in the DLV and hence is insecure) Tha

Workaround for 'rndc stop' ?

2009-12-08 Thread kalpesh varyani
Hi all, Can anyone please tell me is there any other command by which i can stop the name-server without loosing the recent updates. I know that I can do this by issuing 'rndc stop' but for some reason I am not able to . What are the different ways by which I can have the same benefits as t

Re: Bind slave to Windows 2008 AD/DNS

2009-12-08 Thread bsfinkel
Jukka Pakkanen wrote: >Thanks. Those 6 zones are subdomains to company.local so I guess they >are covered. What about the _msdcs.company.local, is that needed in >slaves? If the zone company.local is mastered on a MX Windows DNS Server, then that zone will contain the records that would

Re: BIND9 slave

2009-12-08 Thread Kevin Darcy
Chris Thompson wrote: On Dec 7 2009, Kevin Darcy wrote: [...snip...] Or, you can run a script on the slaves which consults some centralized "zone slaving database" to determine what zones to slave, or to stop slaving. This "zone slaving database" can take many forms. One idea is to represent

Re: Bind slave to Windows 2008 AD/DNS

2009-12-08 Thread Jukka Pakkanen
Chris Buxton kirjoitti: On Dec 7, 2009, at 2:47 PM, Jukka Pakkanen wrote: I have out Bind servers running as slaves to Windows 2008 DNS server, and it's working fine as far as I can see (except that the slaves after a period of times lose the data and never update it unless restart the Bind

Re: DNSSEC Bogus NXDOMAIN survives authenticating RR

2009-12-08 Thread Niobos
On 08 Dec 2009, at 15:18, Hauke Lampe wrote: > Niobos wrote: > >> When requesting a lookup of "removed", I get a SERVFAIL as well. However, >> every subsequent request for "removed" gets an NXDOMAIN. (dig outputs below) >> Flushing the caches on the RR with "rndc flush" causes the first request t

Re: Disable Refused answer

2009-12-08 Thread Tony Finch
On Fri, 4 Dec 2009, Chris Thompson wrote: > > [It's never been entirely clear to me why these functions have to be > combined, especially given that "server [ipaddr/len] {bogus yes;};" > can be used to block outgoing queries.] The CIDR syntax for server clauses is relatively new. Before it was add

Re: DNSSEC Bogus NXDOMAIN survives authenticating RR

2009-12-08 Thread Hauke Lampe
Niobos wrote: > When requesting a lookup of "removed", I get a SERVFAIL as well. However, > every subsequent request for "removed" gets an NXDOMAIN. (dig outputs below) > Flushing the caches on the RR with "rndc flush" causes the first request to > be a SERVFAIL again. I cannot reproduce this b

Re: Building 9.6.1-P2 on Solaris 10?

2009-12-08 Thread Martin Wismer
Hello Howard, hello Solaris Users, It's there : http://sunfreeware.com Many thank's to Steven M. Christensen Greetings Martin ___ bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users

Re: Signing with the KSK and ZSK

2009-12-08 Thread Mark Andrews
In message <2ac8e9ad0912072303u6327b50eoc06cbfe232632...@mail.gmail.com>, xu dong writes: > > Hi folks, i have a question about signing zone files with the ksk and the > zsk, as i know,when signing the zone files i have to use the ksk and zsk > both,just as following: > > *dnssec-signzone -o do

Re: Signing with the KSK and ZSK

2009-12-08 Thread Chris Buxton
On Dec 8, 2009, at 2:03 AM, xu dong wrote: > Hi folks, i have a question about signing zone files with the ksk and the > zsk, as i know,when signing the zone files i have to use the ksk and zsk > both,just as following: > > dnssec-signzone -o domain-name -t -k KSK zone-name ZSK > but i want to

Re: Bind slave to Windows 2008 AD/DNS

2009-12-08 Thread Chris Buxton
On Dec 7, 2009, at 2:47 PM, Jukka Pakkanen wrote: > I have out Bind servers running as slaves to Windows 2008 DNS server, and > it's working fine as far as I can see (except that the slaves after a period > of times lose the data and never update it unless restart the Bind process, > but that's

Re: BIND9 slave

2009-12-08 Thread Chris Thompson
On Dec 7 2009, Kevin Darcy wrote: [...snip...] Or, you can run a script on the slaves which consults some centralized "zone slaving database" to determine what zones to slave, or to stop slaving. This "zone slaving database" can take many forms. One idea is to represent this list as a special

Building 9.6.1-P2 on Solaris 10?

2009-12-08 Thread Howard Wilkinson
Does anybody have a magic configure description of what is needed to build Bind-9.6.1-P2 on Solaris 10 using native compilers and supporting the dlz-ldap features. When I run under our environment I get the following errors from the build. "../../contrib/dlz/drivers/dlz_ldap_driver.c", line 1