Re: Performance Tuning RHEL 5 and Bind

2013-10-28 Thread Charles Swiger
Hi— On Oct 28, 2013, at 9:05 PM, Alan Clegg wrote: > Slave X.internal.example.com +1; it’s also worth looking into why there is such a high volume of DNS queries. Is it simply a big network with a lot of chatty clients? Or is TTL turned down so low that client side caching is not effective and

Re: Performance Tuning RHEL 5 and Bind

2013-10-28 Thread Alan Clegg
On Oct 28, 2013, at 8:08 PM, brett smith wrote: > OK I have the source of the problem now I just need an elegant way to > fix it and most cost ( Network TCP ) effective way to fix it > > The Windows Domain is responsible for X.internal.example.com and I am > presently forwarding X.internal.exa

Re: Performance Tuning RHEL 5 and Bind

2013-10-28 Thread brett smith
OK I have the source of the problem now I just need an elegant way to fix it and most cost ( Network TCP ) effective way to fix it The Windows Domain is responsible for X.internal.example.com and I am presently forwarding X.internal.example.com to their nameservers DC, resulting in TCP queries. W

RE: Reverse look-up returns root servers?

2013-10-28 Thread Shawn Bakhtiar
I'm inksystems.com the vendor is apollocolors.com I reloaded nscd and named, and sent an email to purchasing to have them check it again. I'll also ask her to forward the information to the vendor to sync their TTLs and make sure they add the other name servers, I wonder if their changing over

Re: DNSSEC and split DNS

2013-10-28 Thread David Newman
On 10/28/13 1:46 PM, Mark Andrews wrote: > In message <526eba87.7040...@networktest.com>, David Newman writes: >> >>> 3. Another internal nameserver gets intermittent dig +dnssec errors on >>> queries for internal resources. Sometimes after a restart, the result is >>> NOERROR and other times it's

Re: Reverse look-up returns root servers?

2013-10-28 Thread Matus UHLAR - fantomas
On 28.10.13 16:07, Shawn Bakhtiar wrote: When I look-up the reverse at my recursive server I get: prompt> dig -x 198.173.12.21 ;; AUTHORITY SECTION: 12.173.198.in-addr.arpa. 40828INNSauth2.dns.cogentco.com. 12.173.198.in-addr.arpa. 40828INNSauth5.dns.cogentco.com. 12.17

Re: DNSSEC and split DNS

2013-10-28 Thread Mark Andrews
In message <526eba87.7040...@networktest.com>, David Newman writes: > > > 3. Another internal nameserver gets intermittent dig +dnssec errors on > > queries for internal resources. Sometimes after a restart, the result is > > NOERROR and other times it's NXDOMAIN or SERVFAIL. Inconsistant use of

Reverse look-up returns root servers?

2013-10-28 Thread Shawn Bakhtiar
background: last month we enabled the feature on sendmail to do a reverse look-up of the name and verify the IP address before accepting an email for delivery FEATURE(`require_rdns')dnl. I know this breaks the RFC but given all the spam this actually helps weed out a few. Received a call from p

Re: DNSSEC and split DNS

2013-10-28 Thread David Newman
On 10/25/13 6:11 PM, David Newman wrote: > > > On 10/23/13 5:20 PM, Mark Andrews wrote: >> In message <5268626c.8040...@networktest.com>, David Newman writes: >>> On 10/23/13 4:28 PM, Mark Andrews wrote: You sign all versions of the zone. As for key management you can: >

Re: use bind 9.8 as caching server and authoritative nameserver

2013-10-28 Thread Steven Carr
You're seriously over-complicating the admin for yourselves by creating dummy zones. Look at RPZ as this will achieve what you want in a much simpler and easier to manage way. Steve On 28 October 2013 13:10, wrote: > Hi all , > > I installed a new bind caching server called nameserver.hiddendo

use bind 9.8 as caching server and authoritative nameserver

2013-10-28 Thread bind-check
Hi all , I installed a new bind caching server called nameserver.hiddendomain.be by using Ubuntu server 12.04.3 LTS with the included bind version : 9.8.1.dfsg.P1-4 for testing. We are a tiny ISP for some regional customers so we don't use forwarders, we host the caching servers for them.