Re: resolver: DNS format errors

> On 4 Oct 2023, at 06:31, Petr Menšík wrote: > > Hi Mark, > > I have seen this error before and I admit it is quite annoying. Especially > when the owners of failing implementations refuse to fix their bugs. Is there > any possibility to tune this only for set of broken servers? > > server

Re: resolver: DNS format errors

Hi Mark, I have seen this error before and I admit it is quite annoying. Especially when the owners of failing implementations refuse to fix their bugs. Is there any possibility to tune this only for set of broken servers? server prefix {} block can set different features for selected serve

Re: Hyperlocal RFC8806 Root Mirror

Hi Silva, I do not understand that tutorial language and you have not shared much details what it should do. But note that bind will cache both positive and negative (non-existent) answers, so repeated tests answers are delivered from cache even when local domain is not present. I would recom

Re: Is bind 9.18.19 a validating resolver to shield against CVE-2023-42119 ?

Hi there On 02/10/2023 11:06, Kurt Jaeger wrote: In the light of the recent exim security issues[1,2] I'm trying to find out if bind 9.18.19, if used as resolver, does enough validation to shield exim instances from CVE-2023-42119 ? I added 'check-names response fail;' to the internal view.

Re: Is bind 9.18.19 a validating resolver to shield against CVE-2023-42119 ?

Hi Kurt, we do not ship exim in RHEL, so nobody from our team did proper work on these vulnerabilities. From the few information that I have found, I would just guess BIND9 or Unbound should help protecting exim. Dnsmasq or coredns do not create full response message from scratch, but forward