Re: auto-dnssec maintain and DNSKEY removal

2016-07-04 Thread Tony Finch
Mathew Ian Eis wrote: > > We think that in some cases, named may be choosing to use a key past the > removal date (as in [2]), while our file maintenance process removes the > keys as per their deletion date – after which named no longer has the > necessary metadata to determine whether or not to

Re: Automatic DNSSEC signing workflow

2016-07-04 Thread Tony Finch
Tony Finch wrote: > dramaley wrote: > > > Hello. I'm running Bind 9.9.4 (the default that comes with RHEL 7). I'm > > trying to figure out a workflow for doing DNS updates with auto-dnssec > > turned on. When I have to update a zone file, I do so by editing the zone > > file and incrementing the

Re: Automatic DNSSEC signing workflow

2016-07-04 Thread Tony Finch
dramaley wrote: > Hello. I'm running Bind 9.9.4 (the default that comes with RHEL 7). I'm > trying to figure out a workflow for doing DNS updates with auto-dnssec > turned on. When I have to update a zone file, I do so by editing the zone > file and incrementing the serial number, then restarting

RE: bind-users Digest, Vol 1727, Issue 1

2016-07-04 Thread G.W. Haywood
Hi there, On Mon, 4 Jul 2016, Amit Kumar Gupta wrote: [An entire digest message, which I've snipped] It would be extremely helpful to those of us on the digest list, and generally more polite, if you would NOT include in your posts to the list, simply in order to save yourself the time and ef

Re: bind-users Digest, Vol 2427, Issue 1

2016-07-04 Thread Mukund Sivaraman
On Mon, Jul 04, 2016 at 05:18:27PM +0530, Amit Kumar Gupta wrote: > Dear All, > Please find the desired o/ps. > > bash-3.2# dig dropbox.com @203.94.243.70 > > ; <<>> DiG 9.6-ESV-R4-P2 <<>> dropbox.com @203.94.243.70 > ;; global options: +cmd > ;; connection timed out; no servers could be reached

RE: bind-users Digest, Vol 2427, Issue 1

2016-07-04 Thread Amit Kumar Gupta
ION: > ;203.94.243.70. IN A As you can see, due to the incorrect syntax, it's attempting to resolve the address record of the name "203.94.243.70." which is probably not what you want. Please start by upgrading your systems (resolvers) to use a

Re: bind-users Digest, Vol 1727, Issue 1

2016-07-04 Thread Mukund Sivaraman
Hi Amit On Mon, Jul 04, 2016 at 04:32:07PM +0530, Amit Kumar Gupta wrote: > Dear All, > > We are Tier 2 ISP in Delhi. Our subscribers are not able to open dropbox.com > using our DNS IPs. > BIND version is 9.8.0. > > Regards > Manager(Internet-Systems) > MTNL Delhi As an internet user, I'd exp

Re: bind-users Digest, Vol 1727, Issue 1

2016-07-04 Thread Mark Andrews
If you want to query a server then you do dig @ e.g. dig dropbox.com @203.94.243.70 I suggest that you run "dig +trace dropbox.com" and see where that fails. It should return something like below if everything goes ok. Mark ; <<>> DiG 9.11.0a3 <<>> +trace dropbox.com ;; global optio

RE: bind-users Digest, Vol 1727, Issue 1

2016-07-04 Thread Amit Kumar Gupta
Dear All, We are Tier 2 ISP in Delhi. Our subscribers are not able to open dropbox.com using our DNS IPs. BIND version is 9.8.0. Packet captured of dns query is as below. snoop -i cc040716 -v -p 320 -x 0 ETHER: - Ether Header - ETHER: ETHER: Packet 320 arrived at 14:55:7.45529 ETHER

RE: Issues resolving outlook.office365.com

2016-07-04 Thread Ondřej Holas
Hello Mark, similar problem can be reproduced on recursive non-forwarding server by setting "max-cache-ttl" to some low value (in production I have 3600, for quick reproduction set it to 10) and sending query "in the last second of TTL", for example: == code begin == while true; do dig -p 5353 @l