Re: Syncing DNS zones with different names

2011-11-14 Thread Barry Margolin
In article , "Chris Balmain" wrote: > Let's say I have two domain names, d1.com and d2.com, and I want to > synchronise all records underneath them (one-way sync, that is). So if I > create an A record www.d1.com pointing at 1.2.3.4, www.d2.com is also > automatically created, with the same v

Syncing DNS zones with different names

2011-11-14 Thread Chris Balmain
Let's say I have two domain names, d1.com and d2.com, and I want to synchronise all records underneath them (one-way sync, that is). So if I create an A record www.d1.com pointing at 1.2.3.4, www.d2.com is also automatically created, with the same value. So it's almost like a master/slave relat

Re: Help with dig to check NS servers for DNSSEC setup

2011-11-14 Thread Eduardo Bonsi
Barry; Thanks, I fixed that! I am also not sure if that will help with the server "fail" or status "refused" issue when checked from outside. Eduardo On 11/14/11 6:58 PM, Barry Margolin wrote: In article, Eduardo Bonsi wrote: Since my servers are getting status "refused" from outside, c

Re: Help with dig to check NS servers for DNSSEC setup

2011-11-14 Thread Barry Margolin
In article , Eduardo Bonsi wrote: > Since my servers are getting status "refused" from outside, could > someone shine me a light what is wrong here? Here is a copy of my named > conf file for the master. You have the same 'match-clients {any;}' clause in both the internal and external views.

Re: Help with dig to check NS servers for DNSSEC setup

2011-11-14 Thread Eduardo Bonsi
Since my servers are getting status "refused" from outside, could someone shine me a light what is wrong here? Here is a copy of my named conf file for the master. Thanks! // // Include keys file key rndc-key { algorithm hmac-md5; secret "yyxx-not-the-real-key-xmc/xxx/z/x==";

Re: Help with dig to check NS servers for DNSSEC setup

2011-11-14 Thread Stephane Bortzmeyer
On Mon, Nov 14, 2011 at 12:38:44PM -0800, Eduardo Bonsi wrote a message of 123 lines which said: > if my ns1 and ns2 are responding ok to setup DNSSEC. ... > user:~ user1$ dig bonsi.org dig, by default, does not request DNSSEC data. If you want to test with DNSSEC, add "+dnssec" to the comman

Re: DNS Amplification Attack and different results in bind 9.6/9.7

2011-11-14 Thread Stephane Bortzmeyer
On Tue, Nov 15, 2011 at 03:51:52AM +0900, Euiho Kim wrote a message of 215 lines which said: > In bind-9.6 installed server, response query rcvd msg size is 600~700 byte, > > But bind-9.7, response rcvd msg size is 3100~3400 byte(large size), It > includes lots of DNSSEC RRSet. I vaguely rem

RE: Help with dig to check NS servers for DNSSEC setup

2011-11-14 Thread lst_hoe02
Zitat von "Adamiec, Lawrence" : Here are some results using the same commands you used. # dig @63.200.45.18 ns1.bonsi.org soa ; <<>> DiG 9.6.1-P3 <<>> @63.200.45.18 ns1.bonsi.org soa ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 9

RE: Help with dig to check NS servers for DNSSEC setup

2011-11-14 Thread Adamiec, Lawrence
Here are some results using the same commands you used. # dig bonsi.org ; <<>> DiG 9.6.1-P3 <<>> bonsi.org ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 1462 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION:

Help with dig to check NS servers for DNSSEC setup

2011-11-14 Thread Eduardo Bonsi
I am checking my DNS setup from inside using dig and I am getting everything ok but I need a second opinion from outside of the server to see if my ns1 and ns2 are responding ok to setup DNSSEC. Thanks! user:~ user1$ dig bonsi.org ; <<>> DiG 9.6-ESV-R4-P3 <<>> bonsi.org ;; global options: +cm

DNS Amplification Attack and different results in bind 9.6/9.7

2011-11-14 Thread Euiho Kim
Hi, I wrote email 1 days ago (subject name: DDoS attack and difference actions in bind 9.6 / 9.7) But I wonder mail could not approach to your mailbox, so I request support again. First, Recently “isc.org ANY” DDoS Attack is frequently generated in our DNS System (recursive Cache DNS) Query ty

Re: Reason for Limited number of Root DNS Servers

2011-11-14 Thread Florian Weimer
* Gaurav Kansal: > As root DNS are running in anycast so number is not an issue at all. But I > don't understand where exactly is this limitation exists??? The limitation does not exist, otherwise it would not have been possible to add IPv6 addresses to the priming response. -- Florian Weimer