Re: FORMERR responses after upgrading resolver from 9.16 to 9.18.8

2022-10-21 Thread Hugo Salgado
> > On 21 Oct 2022, at 12:23, Ondřej Surý wrote: > > > > What you are really saying that we should dance how tech giants whistle, > > and I don’t think succumbing to tech giants is a good strategy long term. > > Not at all and I agree with you. > > But tell your customer that their email mess

Re: What action to take first with DS algorithm migration?

2022-09-14 Thread Hugo Salgado
On 11:23 14/09, frank picabia wrote: > Hi, > > I'm at the point in DNSSEC algorithm migration > where I have two types of keys involved in signing. > Both algorithm 7 and 8 are in use. > > The top level domain registrar also has DS keys set up for both 7 and 8. > > I need to coordinate pulling o

Re: dnssec rookie question

2022-01-10 Thread Hugo Salgado
On 16:48 10/01, Danilo Godec via bind-users wrote: > Hello, > > > today I implemented DNSSEC for a domain - by that I mean that the DS records > have been published / added to TLD DNS today, while the zone has been signed > a couple of days ago. > > > So a couple of hours later I went to https:

Re: (BIND) Re: Change records in DNS slave if master is offline

2021-12-19 Thread Hugo Salgado
On 05:12 19/12, Richard Doty wrote: > Having text files makes editing easier, but you still want to keep the > slaves the same - making the identical edit multiple times is some work, > but may not actually happen depending on circumstances (people make > mistakes) > > I like to make all the serve

Re: Testing KASP, CDS, and .ch

2021-04-09 Thread Hugo Salgado
Switch has a website to test the CDS processing for .ch: https://www.nic.ch/security/cds/ for domainmail.ch it says "The CDS configuration of the domain name domainmail.ch will not be processed. [ ... ] The DNS query returned: "Server failed to complete the DNS request". " You should check the

Re: Broken signatures on packages.sury.org

2021-03-17 Thread Hugo Salgado
I found just today the same expiration of Ondrej key with some Debian php packages. Was solved downloading the new one: https://www.patreon.com/posts/dpa-new-signing-25451165 Hugo On March 17, 2021 8:20:13 PM GMT-03:00, Mark Andrews wrote: >I’ve pinged Ondrej but he is likely asleep as he is

Re: can bind support DOH and DoT (and broken mailing list archive)

2020-06-02 Thread Hugo Salgado
On 12:01 02/06, Tony Finch wrote: > ShubhamGoyal wrote: > > > > 1. Can bind support DoH and DoT > > There was more discussion in May but unfortunately the mailing list > archive seems to have got into a muddle so the messages aren't available > https://lists.isc.org/mailman/htdig/bind-users/2020-

Re: Vim Syntax, New Release for ISC Bind named.conf 5.16

2020-04-22 Thread Hugo Salgado
Thanks a lot Steve, works like a charm! It's nice to have well formatted SSHFP records at last! :) Regards, Hugo Salgado On 14:32 22/04, Steve Egbert wrote: > Hello, Bind-Users, > > > This is my 2nd post (in 19 years). > > I'm announcing the release of ISC Bind

Re: Should we remove the DLV code?

2019-05-21 Thread Hugo Salgado-Hernández
Last year I was involved in a project to allow the signing of domains in the second level of a country, when the TLD has signed yet. It's a reality in certain regions. I get it that the idea is to put pressure on the TLD, but this institution was the largest ISP in the country and considered that i

Re: [BIND] RE: KSK Rollover

2018-09-06 Thread Hugo Salgado-Hernández
Hi Brent. In out CentOS box, the named.secroots file is written on /var/named/ You should check permissions there too. Hugo On 20:32 06/09, Brent Swingle wrote: > Evan, > > I ran the command and followed the directions to build out rndc as you have > suggested. However, I am not sure that i

Re: [BIND] Why log a failed transfer successfully?

2015-04-02 Thread Hugo Salgado
On 04/02/2015 05:01 AM, Anand Buddhdev wrote: > I'm parsing BIND logs to extract the XFR size in bytes of a zone, and > was just bitten by this sequence: > > 02-Apr-2015 04:27:10.393 xfer-in: transfer of './IN' from > 2001:67c:2e8:5::c100:c6#53: failed to connect: timed out > 02-Apr-2015 04:27:10

Re: DNSSEC key rollover problems

2011-12-29 Thread Hugo Salgado
On 12/28/2011 10:42 PM, Spain, Dr. Jeffry A. wrote: > > First of all is it correct that the time stamps shown by dig for RRSIG > records are in local time? Otherwise, if the time stamps show UTC, then > the RRSIG for jaspain.net SOA for ZSK 42152 was generated at > 2011121023, one hour prior t

Re: Spaces in keys

2010-11-17 Thread Hugo Salgado
On 11/17/2010 05:01 PM, Thomas Schulz wrote: > When I copied the key for root from > http://www.isc.org/community/blog/201007/using-root-dnssec-key-bind-9-resolvers > I ended up with spaces in the key. I assumed that they should not be there > and removed them. I since noticed that the key in /etc/

Re: is it possible to dynamically update an RRSIG record?

2010-01-25 Thread Hugo Salgado Hernandez
Jack Tavares wrote: > Looking at the code for libbind, specifically > res_nmkupdate, > there is no case statement for RRSIG records. > > In this case, I was trying to update the TTL. > Is that not allowed intentionally? I think so. The TTL of a RRSIG RR *MUST* match the TTL value of the RRset i