Re: bind/sendmail resolving.. (NXDOMAIN)

2013-09-20 Thread David Miller
On 9/20/2013 7:28 PM, Mark Andrews wrote: > > In message <021501ceb653$ede37250$c9aa56f0$@leadmon.net>, "Howard Leadmon" > writ > es: >> This is probably easier than I am making it, but my googlefu seems to be >> failing me at the moment when I look around. I handle a batch of FreeBSD >> s

Re: long SPF txt record

2013-06-20 Thread David Miller
On 6/20/2013 1:13 PM, Koehler, Charles wrote: > Our email group wants to change the current SPF txt record and replace it > with one that is 274 characters. > > How can I put it in so that it works correctly? > > Thanks > --cwk >From RFC 4408 ( http://www.ietf.org/rfc/rfc4408.txt ) 3.1.3. M

Re: DNS Amplification Attacks... and a trivial proposal

2013-06-13 Thread David Miller
On 06/13/2013 05:33 AM, Phil Mayers wrote: > On 06/13/2013 06:31 AM, Ronald F. Guilmette wrote: > >> 1) If everyone on the planet were to somehow magically and >> immediately be >> converted over to DNSSEC tomorrow, then would DNS amplification attacks >> become a thing of the past, starting tomor

Re: Disable log message

2012-10-19 Thread David Miller
On 10/19/2012 11:57 PM, Chris Buxton wrote: > On Oct 19, 2012, at 6:22 PM, Warren Kumari wrote: >> On Oct 19, 2012, at 9:17 PM, "Michael Hoskins (michoski)" >> wrote: >>> -Original Message- On Oct 19, 2012, at 6:13 PM, Alan Clegg wrote: > > On Oct 18, 2012, at 1:13 PM

Re: Version statement...

2012-08-16 Thread David Miller
On 8/17/2012 1:13 AM, Jeff Justice wrote: > I am trying to mask our DNS servers version output to a custom string, but it > doesn't seem to be working for me. In a nutshell, I have added this to my > options block of my named.conf: > >version "[DNS Server]"; options { version "str

Re: Getting a formerr 'invalid response' for winqual.microsoft.com. but dig +trace works.

2012-02-08 Thread David Miller
On 2/8/2012 10:32 PM, Matt Doughty wrote: I have spend the afternoon trying to figure this out. The response I get back from their nameserver looks fine to me, and dig +trace works fine, but a regular dig returns a servfail. I have looked at the code for invalid response, but I don't quite follow

Re: Defense against a client?

2012-01-16 Thread David Miller
Mark Andrews wrote: > >In message , >Barry Mar >golin writes: >> In article , >> Chuck Anderson wrote: >> >> > On Mon, Jan 16, 2012 at 03:41:15PM +, Florian Weimer wrote: >> > > * Chuck Anderson: >> > > >> > > > Unfortunately, these sorts of per-IP limiting are going to >become more >>

Re: host versus nslookup

2011-10-12 Thread David Miller
On 10/12/2011 3:01 PM, Kevin Darcy wrote: On 10/12/2011 1:21 PM, Martin McCormick wrote: Many years ago, various flavors of unix began distributing a utility called host which did almost the same thing as nslookup. Host is what I use most of the time, now, and I actually thought that nslookup on

Re: NXDOMAIN redirection in BIND 9.9

2011-09-30 Thread David Miller
On 9/30/2011 6:21 PM, Shawn Bakhtiar wrote: "We came to the conclusion that no matter how much we wanted it to not be true, people find a way to do NXDOMAIN if they want to. The issue is not ours to push, it's between the ISP and the customer ultimately, and people will do it -- and more intr

Re: CNAME / MX Record question

2011-08-07 Thread David Miller
On 8/7/2011 9:05 AM, Scott Hughes wrote: All, I have Googled and searched the archives for two days and cannot find an answer to this question... just more confusion! Please forgive me ahead of time as I run two name servers for my mid-sized company and am by no means an expert in using bind

Re: nameserver registration

2011-06-18 Thread David Miller
On 6/18/2011 12:24 PM, Lyle Giese wrote: On 06/18/11 09:30, Jorg W. wrote: Greetings, given my domain name is example.net, and my NS servers for example.net are: ns1.example.com ns2.example.com But, example.com itself's NS servers are the registrator's (for example, godaddy's). Under this

Re: An Invitation to Neuroscientists and Physicists: Singapore Citizen Mr. Teo En Ming (Zhang Enming) Reports First Hand Account of Mind Intrusion and Mind Reading

2011-05-17 Thread David Miller
On 5/17/2011 2:07 PM, Warren Kumari wrote: On May 17, 2011, at 1:17 PM, Michelle Konzack wrote: 69th Spam/Mailinglist (I am subscribed to 137 lists) How is it possibel, this guy is spaming at least 69 mailinglists where most are subscriber only? Um, maybe his claims are true -- if "Mind Int

Re: incorrect dns returned by public servers for our domain

2011-02-23 Thread David Miller
On 2/24/2011 1:19 AM, Matthew Seaman wrote: On 24/02/2011 04:14, Noel Butler wrote: You can pretty much remove the entire statement now, as all /8's are issued as of about two weeks ago. This works for me: lucid-nonsense:~/src/namedb:% cat acl-ipv4-bogons.conf // @(#) $Id: acl-ipv4-bogons.conf

Re: Bind and blacklist IP file

2010-10-11 Thread David Miller
level could lead to many surprises. -- -_______ David Miller Tiggee LLC dmil...@tiggee.com ___ bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users

Re: non-24 bit subnets

2010-10-06 Thread David Miller
info/bind-users -- -_______ David Miller Tiggee LLC dmil...@tiggee.com ___ bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users

Re: Here I am again, hat in hand with humble demeanor.......

2010-09-24 Thread David Miller
'CFLAGS=-O2 -march=native' 'CXXFLAGS=-O2 -march=native' -- -___ David Miller Tiggee LLC dmil...@tiggee.com ___ bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users

Re: Master server offline

2010-05-06 Thread David Miller
Secondaries need to 'know' that this old sec is now a master as well. DNS is kind of critical (unless your internet presence is not important), so ... Knowing nothing about you org... Would rec that you priortise fixing DNS pretty highly. -- -_______ Da

DNSSEC - Root zone - FUD

2010-05-03 Thread David Miller
All, There has been quite a bit of FUD bouncing around the net regarding the May 5th signing of the root zone and the sky falling (or at least massive failures across the internet). I have been asked multiple times about how I was going to prevent the internet from collapsing for my users.

Re: DNSSEC

2010-04-30 Thread David Miller
I assume that you are asking about providing authoritative DNS for example.com. Should you deploy DNSSEC? Yes, if you want your query responses to be validated by DNSSEC resolvers. Does this have anything to do with the DNSSEC signing of the root domain? No, not really. Unless your TLD'