RE: Windows 9.16.25 fails to start (1067 Terminated unexpectedly)

2022-02-11 Thread Richard T.A. Neal
I run BIND on Windows as well but I've been unable to upgrade to 9.16.25 - I get an error stating "Error Validating Account. Unable to install service using this account.". So I'm presently running 9.16.21. What are the last few things in the Application Event Log (Source: named) before it term

Re: Obsoleting keep-response-order option in BIND 9.19/9.20+

2022-02-11 Thread Ondřej Surý
Thanks Fred, those are all good advices for the DNS over TCP implementors. Ondřej -- Ondřej Surý — ISC (He/Him) My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours. > On 11. 2. 2022, at 18:32, Fred Morris wrote: > >

Re: Obsoleting keep-response-order option in BIND 9.19/9.20+

2022-02-11 Thread Fred Morris
It's not BIND's fault or responsibility, but I hope it is well documented and remains well documented. On Fri, 11 Feb 2022, Ondřej Surý wrote: [...] when out-of-order response processing was introduced in BIND 9.11.0, there was a “defensive” option added called keep-response-order that takes AC

Re: Bind: Standard Ports And Non Standard Ports

2022-02-11 Thread Warren Kumari
On Fri, Feb 11, 2022 at 10:21 AM Tim Daneliuk via bind-users < bind-users@lists.isc.org> wrote: > > After some months of poking around, we are now certain that our so-called > "Business" > service from Comcast is compromising our DNS servers because of their > execrable "Security Edge" garbage. (

Re: Bind: Standard Ports And Non Standard Ports

2022-02-11 Thread Ted Mittelstaedt
I have Comcast Business with 2 name servers behind it and 50 or so domain names hosted on them. No problems at all. Never heard of Security Edge. We could have a discussion on your setup and compare notes but your problems have nothing to do with port 53 filtering in the Comcast network, IMHO.

Re: Is there a community product maintaining Windows support?

2022-02-11 Thread Ted Mittelstaedt
I just became a maintainer on the apcupsd project. I don't know if bind for windows is built like apcupsd is, by using mingw32 but unfortunately there's problems with the mingw32 project these days, it's gone through a lot of transitions. Getting a working build environment for apcupsd at lea

Re: Bind: Standard Ports And Non Standard Ports

2022-02-11 Thread Ondřej Surý
Yes, look for “port” configuration in the documentation: https://bind9.readthedocs.io/en/v9_16_25/ You can configure the upstream to listen on non-standard port and the downstream to use it. We use this internally in the system tests. As a side note please separate the technical questions and r

Re: Bind: Standard Ports And Non Standard Ports

2022-02-11 Thread Jakob Bohm via bind-users
On 2022-02-11 16:20, Tim Daneliuk via bind-users wrote: After some months of poking around, we are now certain that our so-called "Business" service from Comcast is compromising our DNS servers because of their execrable "Security Edge" garbage.  (They are willing to remove this 'service' on

Is there a community product maintaining Windows support?

2022-02-11 Thread Jakob Bohm via bind-users
As ISC has apparently announced that it will no longer maintain the code for running bind on Windows operating systems, and that this is now up to the community, is there a community group that has stepped up to the task? Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wise

Bind: Standard Ports And Non Standard Ports

2022-02-11 Thread Tim Daneliuk via bind-users
After some months of poking around, we are now certain that our so-called "Business" service from Comcast is compromising our DNS servers because of their execrable "Security Edge" garbage. (They are willing to remove this 'service' only if we are willing to incur a higher monthly recurring fe

Windows 9.16.25 fails to start (1067 Terminated unexpectedly)

2022-02-11 Thread Jakob Bohm via bind-users
Dear list, When recently trying to upgrade some secondary-only authoritative servers running on Windows machines, I found that Bind 9.16.25 (x86_64) binaries from isc.org failed to completely startup, causing Windows to report that "1067 The process terminated unexpectedly.", with 0 process e

Changing ZSK-lifetime in dnssec-policy is not applied

2022-02-11 Thread Tom
Hi Using BIND-9.16.22 and dnssec-policy: I've migrated an already existing and signing "auto-dnssec"-configured zone to dnssec-policy (same algorithms). That worked without any issues. After a while, I changed the ZSK lifetime from 30d to 60d (see below) in the dnssec-policy: dnssec-policy

Obsoleting keep-response-order option in BIND 9.19/9.20+

2022-02-11 Thread Ondřej Surý
Hi, when out-of-order response processing was introduced in BIND 9.11.0, there was a “defensive” option added called keep-response-order that takes ACL as option to enable the previous behaviour where the DNS responses were sent in the same order as the received DNS queries. For BIND 9.19 (develo

Re: dnssec: ds showing hidden 3+ days after key roll

2022-02-11 Thread Matthijs Mekking
Hi Larry, This is documented in the DNSSEC RFCs, but AFAICS it is not mentioned in our documentation. I created a merge request to add such a note in the appropriate places: https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5823 Best regards, Matthijs On 10-02-2022 18:23, Larry Ro