need to disable dnssec for pseudo TLD zone

2010-10-27 Thread Antonio Querubin
When I recently installed the root dnssec initial key on our DNS it broke it's ability to accept responses for forwarded requests for a DNS block list zone served by another system. Other queries aren't affected. The config for the forwarded zone looks like: zone "dnsbl" { type forwa

Re: out of place mx records.

2010-10-27 Thread Andrey G. Sergeev (AKA Andris)
Hello Gregory, Thu, 28 Oct 2010 15:54:32 +1300 Gregory Machin wrote: > Hi Andrey. > Thanks for you input. > > OK .. but most of those hosts should not be accepting email > connections, buy my understanding. Or is it implied that email > destined for that host would be handled by the email serv

Re: non-improving referral

2010-10-27 Thread Mark Andrews
In message <20101026161348.gj2...@omroep.nl>, Leo Baltus writes: > Hi, > > We are in the process of migrating from bind-9.4-ESV-R2 to bind-9.7.2-P2. > > We have our authoritative servers migrated to bind-9.7.2-P2 and it all > seems to work fine. > > While testing our caching resolvers with bind

Re: out of place mx records.

2010-10-27 Thread Barry Margolin
In article , Sten Carlsen wrote: > To me it looks redundant, "named-compilezone -o - zone file" should show > you how bind interprets these. > My guess is that they will be listed only once in the output. I suggest you try it, and you'll see that you guessed wrong. > > I don't see how they co

Re: non-improving referral

2010-10-27 Thread Barry Margolin
In article , Leo Baltus wrote: > Hi, > > We are in the process of migrating from bind-9.4-ESV-R2 to bind-9.7.2-P2. > > We have our authoritative servers migrated to bind-9.7.2-P2 and it all > seems to work fine. > > While testing our caching resolvers with bind-9.7.2-P2 however, we > noticed

Re: out of place mx records.

2010-10-27 Thread Mathieu Imfeld
They prevent people who start a potentially rogue mailserver to receive mails. I.e. You centralize mails and make sure only your authorized mailserver receives them when you dont have full control over these boxes. -mat On Oct 28, 2010, at 8:48 AM, Sten Carlsen wrote: > To me it looks redunda

Re: out of place mx records.

2010-10-27 Thread Andrey G. Sergeev (AKA Andris)
Hello Sten, Thu, 28 Oct 2010 02:48:36 +0200 Sten Carlsen wrote: > To me it looks redundant, "named-compilezone -o - zone file" should > show you how bind interprets these. > My guess is that they will be listed only once in the output. > > I don't see how they could belong to each subdomain, to

Re: out of place mx records.

2010-10-27 Thread Sten Carlsen
To me it looks redundant, "named-compilezone -o - zone file" should show you how bind interprets these. My guess is that they will be listed only once in the output. I don't see how they could belong to each subdomain, to do that there should be a"@..." to set a new origin? On 28/10/10 2:14, Ia

Re: out of place mx records.

2010-10-27 Thread Ian Manners
Hi Gregory, >mail02 IN A 192.168.xx.xx > IN MX 10 mcvpemr01 > IN MX 10 mcvpemr02 >nelson IN A 202.xx.xx.1 > IN MX 10 mcvpemr01 > IN MX 10

Re: out of place mx records.

2010-10-27 Thread Andrey G. Sergeev (AKA Andris)
Hello Gregory, Thu, 28 Oct 2010 13:04:58 +1300 Gregory Machin wrote: > Hi. > I have taken over some dns servers, and the process of doing upgrade, > half way through the process.. > > I have a question about the zone files , as there is some > configuration here that I have not seen before and

out of place mx records.

2010-10-27 Thread Gregory Machin
Hi. I have taken over some dns servers, and the process of doing upgrade, half way through the process.. I have a question about the zone files , as there is some configuration here that I have not seen before and seems out of place. here is an excerpt of the zone file $TTL 14400 @

Re: limiting number of recursion/queries per IP address

2010-10-27 Thread Sebastian Tymków
In FreeBSD you can use pf to limit connections using tables and setting up rate limit. http://forums.freebsd.org/showthread.php?t=1727 Best regards, Shamrock On Tue, Oct 26, 2010 at 9:29 PM, Kebba Foon wrote: > On Tue, 2010-10-26 at 15:22 -0400, Todd Snyder wrote: > > What version of bind, on

Re: Key ID from DNSKEY - how?

2010-10-27 Thread Phil Mayers
On 10/27/2010 06:46 PM, Mark Elkins wrote: I would like to calculate the Key-ID from a DNSKEY record. I'd prefer to do this in PHP as this is inside some existing PHP (Web) scripts but I guess calling a C program would not be too inconvenient. I use some Python code to do this in our debugging/

Re: Key ID from DNSKEY - how?

2010-10-27 Thread Alan Clegg
On 10/27/2010 1:46 PM, Mark Elkins wrote: > I would like to calculate the Key-ID from a DNSKEY record. I'd prefer to > do this in PHP as this is inside some existing PHP (Web) scripts but I > guess calling a C program would not be too inconvenient. [...] > Anyway - does anyone have existing code

Re: Key ID from DNSKEY - how?

2010-10-27 Thread Casey Deccio
On Wed, Oct 27, 2010 at 10:46 AM, Mark Elkins wrote: > I would like to calculate the Key-ID from a DNSKEY record. I'd prefer to > do this in PHP as this is inside some existing PHP (Web) scripts but I > guess calling a C program would not be too inconvenient. > See RFC 4034, Appendix B (http://to

non-improving referral

2010-10-27 Thread Leo Baltus
Hi, We are in the process of migrating from bind-9.4-ESV-R2 to bind-9.7.2-P2. We have our authoritative servers migrated to bind-9.7.2-P2 and it all seems to work fine. While testing our caching resolvers with bind-9.7.2-P2 however, we noticed some errors in our logfiles we have never seen befor

Key ID from DNSKEY - how?

2010-10-27 Thread Mark Elkins
I would like to calculate the Key-ID from a DNSKEY record. I'd prefer to do this in PHP as this is inside some existing PHP (Web) scripts but I guess calling a C program would not be too inconvenient. I'd like to index records (ie DNSKEY and DS Records) according to their Key-ID - and present them