Re: minimal-all on master

2016-09-02 Thread Jim Popovitch via bind-users
On Fri, Sep 02, 2016 at 06:59:35PM +, Jim Popovitch via bind-users wrote: > Hello, > > Should minimal-all (v9.11.0-rc1) work on a master? My testing shows that it > only works on the slave DNS servers. > And by minimal-all I mean minimal-any (i keep typo'ing that for some reason today) :-

minimal-all on master

2016-09-02 Thread Jim Popovitch via bind-users
Hello, Should minimal-all (v9.11.0-rc1) work on a master? My testing shows that it only works on the slave DNS servers. relevant named.conf: http://paste.debian.net/plainh/62ee2440 -Jim P. signature.asc Description: Digital signature ___ Please vi

Re: SERVFAIL takes precedence before RPZ policy action

2016-09-02 Thread Daniel Stirnimann
>> We maintain a block list with RPZ on our BIND resolvers. I noticed that >> the RPZ policy action does not apply for domain names which SERVFAIL >> (i.e. cannot be resolved by the resolver because of a timeout, lame >> delegation etc.). > > RPZ applies to responses not queries. > > You can over

Re: SERVFAIL takes precedence before RPZ policy action

2016-09-02 Thread Phil Mayers
On 02/09/16 15:22, Daniel Stirnimann wrote: Hi all We maintain a block list with RPZ on our BIND resolvers. I noticed that the RPZ policy action does not apply for domain names which SERVFAIL (i.e. cannot be resolved by the resolver because of a timeout, lame delegation etc.). RPZ applies to r

SERVFAIL takes precedence before RPZ policy action

2016-09-02 Thread Daniel Stirnimann
Hi all We maintain a block list with RPZ on our BIND resolvers. I noticed that the RPZ policy action does not apply for domain names which SERVFAIL (i.e. cannot be resolved by the resolver because of a timeout, lame delegation etc.). This happens on both BIND 9.11.0rc1 and 9.9.9-P2. Our default

Re: DNSKEY and RRSIG DNSKEY TTL values aren't changed after changing of zone's TTL

2016-09-02 Thread Aleks Ostapenko
2016-08-31 19:50 GMT+07:00 Tony Finch : > Aleks Ostapenko wrote: > > > > Unfortunately, after > > > > 1. rndc freeze myzone > > 2. named-comilezone -f raw -F text -o myzone.text myzone myzone.signed > > change TTL on DNSKEY and RRSIG DNSKEY in myzone.text > > named-comilezone -f text -F