Re: BIND 9.9.3b1 is now available

2013-01-25 Thread Evan Hunt
> >I have software that reads the stats channel. > > Me too. Took awhile to get right, I'd hate to see it break. :-( The plan is, it *will* break in 9.10, but not in 9.9 (unless you turn the new stats on with the configure option). I'd love it if you'd try it, actually, find out how hard it is

Re: BIND 9.9.3b1 is now available

2013-01-25 Thread Timothe Litt
Maybe it will chug along for a while if you don't configure with newstats. But suppose someday you want to update to the newer, better software. Are you going to run a separate server to test against? If you manage more than one server, when the monitoring software changes, are all the servers

RE: How to measure the impact of enabling DNSSEC?

2013-01-25 Thread Petrov, Andrew
Thanks for sharing Lawrence. One thing I wanted to ask the list is whether it would make more sense to have a KSK rollover a month before the domain expires? What would be cons and pros? Thanks, - Andrew. Andrew Petrov IT Security Engineering NYC DoITT -Original Message- From: bind-

key rollover with BIND 9.9

2013-01-25 Thread Michael W. Lucas
Hi, I'm trying to automate key rollover with BIND 9.9.2 (will soon upgrade to new rev). I have a couple of elementary questions that seem to be answered briefly in the documentation, but I suspect that my grasp of key rollover is clouded by the last decade of blog posts about tools and techniques

Re: Quick reverse dns zone question

2013-01-25 Thread Mark Andrews
In message , Mauricio Tavares writes: > so I want to define a reverse dns zone to handle 172.16.101.64/27. In > the named.conf file I set: > > acl bogusnets { > 0.0.0.0/8; > 1.0.0.0/8; > 2.0.0.0/8; > 192.0.2.0/24; > 224.0.0.0/3; > 10.0.0.0/8; >

Re: BIND 9.9.3b1 is now available

2013-01-25 Thread Mike Hoskins (michoski)
-Original Message- From: Timothe Litt Date: Friday, January 25, 2013 6:13 PM To: "bind-users@lists.isc.org" Subject: Re: BIND 9.9.3b1 is now available >On 25-Jan-13 17:32, Michael McNally wrote: >> BIND 9.9.3b1 is the first beta release of BIND 9.9.3. >> >> Makes available a new X

Re: BIND 9.9.3b1 is now available

2013-01-25 Thread Timothe Litt
On 25-Jan-13 17:32, Michael McNally wrote: BIND 9.9.3b1 is the first beta release of BIND 9.9.3. Makes available a new XML schema (version 3.0) for the statistics channel that adds query type statistics at the zone level, flattens the XML tree and uses compressed format to optimize

Re: Quick reverse dns zone question

2013-01-25 Thread Doug Barton
On 1/25/2013 2:56 PM, Mauricio Tavares wrote: so I want to define a reverse dns zone to handle 172.16.101.64/27. In the named.conf file I set: acl bogusnets { 0.0.0.0/8; 1.0.0.0/8; 2.0.0.0/8; 192.0.2.0/24; 224.0.0.0/3; 10.0.0.0/8; !1

Re: How to measure the impact of enabling DNSSEC?

2013-01-25 Thread Lawrence K. Chen, P.Eng.
- Original Message - > On Wed, Jan 23, 2013 at 11:38 AM, Augie Schwer > wrote: > > > > On Tue, Jan 22, 2013 at 2:32 PM, Mark Andrews > > wrote: > >> > >> > >> In message > >> , > >> Augie > >> Schwer wri > >> tes: > >> > > >> > Would measuring the number of SERVFAIL entries in the > >>

Quick reverse dns zone question

2013-01-25 Thread Mauricio Tavares
so I want to define a reverse dns zone to handle 172.16.101.64/27. In the named.conf file I set: acl bogusnets { 0.0.0.0/8; 1.0.0.0/8; 2.0.0.0/8; 192.0.2.0/24; 224.0.0.0/3; 10.0.0.0/8; !172.16.101.64/27; 172.16.0.0/12; 192.168

BIND 9.6-ESV-R9b1 is now available

2013-01-25 Thread Michael McNally
Introduction BIND 9.6-ESV-R9b1 is the first beta release of BIND 9.6-ESV-R9. BIND 9.6-ESV is an Extended Support Version of BIND. This document summarizes changes from BIND 9.6-ESV-R8 to BIND 9.6-ESV-R9b1. Please see the CHANGES file in the source code release for a complete list

BIND 9.9.3b1 is now available

2013-01-25 Thread Michael McNally
Introduction BIND 9.9.3b1 is the first beta release of BIND 9.9.3. This document summarizes changes from BIND 9.9.2 to BIND 9.9.3b1. Please see the CHANGES file in the source code release for a complete list of all changes. Download The latest versions of BIND 9 software can alwa

BIND 9.8.5b1 is now available

2013-01-25 Thread Michael McNally
Introduction BIND 9.8.5b1 is the first beta release of BIND 9.8.5 This document summarizes changes from BIND 9.8.4 to BIND 9.8.5b1. Please see the CHANGES file in the source code release for a complete list of all changes. Download The latest versions of BIND 9 software can alway

Re: What causes 'zone transfer setup failed' ?

2013-01-25 Thread Jan-Piet Mens
> Note that the log message related to outgoing zone transfers from named, The shame! That's what I get for being at it 17 hours non-stop. I overlooked the -out. Sorry and thank you, Tony. -JP ___ Please visit https://lists.isc.org/mailman/listi

Re: Unexpected wildcard matching

2013-01-25 Thread Tony Finch
ip admin wrote: > > Any idea why the wildcard matching is affected by the individual > levels/labels of > hello.test.com? See RFC 4592 "The Role of Wildcards in the Domain Name System", section 2.2 "Existence Rules" and especially 2.2.2 "Empty Non-terminals": 2.2. Existence Rules The notio

Re: What causes 'zone transfer setup failed' ?

2013-01-25 Thread Tony Finch
Jan-Piet Mens wrote: > > On Fri Jan 25 2013 at 13:45:58 CET, Ben Croswell wrote: > > A common issue is the secondary not being allowed to query the master for > > the SOA of the zone. Ensure the master has an allow-query that includes the > > secondary. > > The BIND slave can query the PowerDNS m

Unexpected wildcard matching

2013-01-25 Thread ip admin
Hello, I want to have a dummy (internal) root NS to resolve specific name hello.test.com to 4.5.6.7, everything else to 1.2.3.4. Using a wildcard does not work as expected (by me), though. 1st attempt: # cat db.root $TTL 86400 @ IN SOA ns1.root.internal. dnsadmin.

Re: What causes 'zone transfer setup failed' ?

2013-01-25 Thread Jan-Piet Mens
On Fri Jan 25 2013 at 13:45:58 CET, Ben Croswell wrote: > A common issue is the secondary not being allowed to query the master for > the SOA of the zone. Ensure the master has an allow-query that includes the > secondary. The BIND slave can query the PowerDNS master (for the SOA over UDP and for

Re: What causes 'zone transfer setup failed' ?

2013-01-25 Thread Ben Croswell
A common issue is the secondary not being allowed to query the master for the SOA of the zone. Ensure the master has an allow-query that includes the secondary. On Jan 25, 2013 6:06 AM, "Jan-Piet Mens" wrote: > Hello, > > I'm seeing quite a number of messages like > > xfer-out: debug 3: c

Re: What causes 'zone transfer setup failed' ?

2013-01-25 Thread Tony Finch
Jan-Piet Mens wrote: > > I'm seeing quite a number of messages like > > xfer-out: debug 3: client 192.168.1.2#54688 (example.com): zone > transfer setup failed >From the source it looks like it will always precede this message with another log line stating the reason. There are lots of p

What causes 'zone transfer setup failed' ?

2013-01-25 Thread Jan-Piet Mens
Hello, I'm seeing quite a number of messages like xfer-out: debug 3: client 192.168.1.2#54688 (example.com): zone transfer setup failed BIND 9.9.2P1 here, configured with: request-ixfr no; transfer-format many-answers; transfers-in 100; transfers-per-ns