Re: allow-update in global options (was Re: bind and certbot with dns-challenge)

2019-04-02 Thread Sam Wilson
On 2019-03-17 20:37:56 +, Alan Clegg said: On 3/17/19 2:51 PM, Alan Clegg wrote: On 3/17/19 7:13 AM, Stephan von Krawczynski wrote: Hello all, I am using "BIND 9.13.7 (Development Release) " on arch linux. Up to few days ago everything was fine using "certbot renew". I had "allow-update"

Re: Selective forwarding?

2019-01-24 Thread Sam Wilson
On 2019-01-23 05:06:03 +, ObNox said: On 22/01/2019 02:20, Grant Taylor via bind-users wrote: Note:  I'm assuming a zone expiry of a week to a month.  I think that would accommodate most outages. I thought of that too :-) A week would be far enough in my case. Be careful of what you me

Re: Need help on RPZ sever, bit urgent

2018-08-09 Thread Sam Wilson
On 2018-08-09 14:00:55 +, Blason R said: For example this one. 18:59:26.905177 IP 192.168.1.120.65049 > 192.168.1.42.53: 42074+ A? 0351dag.com. (29) 18:59:26.905299 IP 192.168.1.42.53 > 192.168.1.120.65049: 42074 NXDomain 0/1/0 (102) $ dig 0351dag.com ; <<>> DiG 9.8.3-P1 <<>> 0351dag.c

Re: restarting bind fixes some resolution issues

2017-07-10 Thread Sam Wilson
On 2017-07-09 15:04:53 +, Matus UHLAR - fantomas said: On 09.07.17 14:36, Dario Corti wrote: Hi, I occasionally have issues updating some packages, with the package manager saying that it cannot resolve deb.nodesource.com. I'm using 1:9.9.5.dfsg-9+deb8u11 and I verified that a bind restart

Re: make AAAA type the default for dig

2017-06-14 Thread Sam Wilson
On 2017-06-14 10:45:30 +, Marco Davids (SIDN) said: Hi, Not sure if this has been proposed before, but I am wondering: Has ISC ever considered to change the default 'dig -t' option from A to ? Or a -H option to do both A and queries in a kind of Happy Eyeballs mode? (Yes, I kno

Re: Unable to slave root zones

2017-04-07 Thread Sam Wilson
On 2017-04-07 15:26:57 +, Matus UHLAR - fantomas said: On 07.04.17 07:36, Mark Knight wrote: I've just noticed (after the slave zones expired), that the root name servers have been refusing my zone transfer requests since the end of March. My confirm is per the standard named.conf exampl

Re: Delegation questions

2016-08-15 Thread Sam Wilson
Speaking as a European, at least for now, I suspect the forwarding mindset is more from the enterprise and security culture rather than being territorial. There's a viewpoint that says things are better if they are tightly controlled and predictable, so always using the same configured path fo

Re: resolution problem

2016-05-19 Thread Sam Wilson
In article , Matus UHLAR - fantomas wrote: > On 18.05.16 14:10, Con Wieland wrote: > >I am having an issue resolving www.cloudsat.cira.colostate.edu from 2 of my > > name servers. I have 2 others with identical configs that resolve > > correctly. A normal lookup shows a server fail but a +trac

Re: Intermittent Issues Resolving Microsoft Hostnames

2016-05-05 Thread Sam Wilson
In article , Stephane Bortzmeyer wrote: > On Wed, May 04, 2016 at 02:02:24PM -0400, > Rob Heilman wrote > a message of 305 lines which said: > > > We run BIND 9.9.5-9 on Debian x86_64 to support a moderately sized > > email hosting system. System info listed at the end of this > > message.

Re: Adding CNAME for the root domain issue

2016-04-27 Thread Sam Wilson
In article , "Baird, Josh" wrote: > Any thoughts on a service like Cloudfare's 'CNAME Flattening' [1]? > > [1] > https://blog.cloudflare.com/introducing-cname-flattening-rfc-compliant-cnames-at-a-domains-root/ Does anyone else find themselves mentally yelling "apex!" whenever they read the

Re: frequent queries to root servers

2016-02-01 Thread Sam Wilson
In article , Grant Taylor wrote: > I think chained CNAMEs fall into the gray area (no mans land) between > zealots on either side of the RFC interpretation line. > > If chained CNAMEs work for you, more power to you. But don't be > surprised if they fail unexpectedly at some point. We shoul

Re: A tale of two nameservers - resolution problems

2015-09-01 Thread Sam Wilson
In article , Robert Moskowitz wrote: > I will be looking more into this. Obvious when you get ones nose > dragged into time wrong on boot. This is actually a broader problem on > arm SoC booting. Your logs all have the wrong time for the boot > messages until there is a network to get time

Re: Digging to the final IP

2014-10-23 Thread Sam Wilson
In article , Bob Harold wrote: > Anytime you see 'grep' and 'cut' used together, they can usually be > shortened to just 'awk', which requires starting one less process. And if > this case it splits fields the way a users sees them, so the same code > works in both cases: > > $ dig +noall +ans

Re: Change in behaviour regarding ndots and searchlist

2014-09-15 Thread Sam Wilson
In article , Steven Carr wrote: > Without the final explicit "." your name is not fully qualified. Except in an email address where a trailing "." is illegal. Sam -- The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336. _

Re: A record of domain name must be name server ?

2014-09-11 Thread Sam Wilson
In article , Antonio Querubin wrote: > On Thu, 11 Sep 2014, Matus UHLAR - fantomas wrote: > > > If you point www CNAME @, the 'www' will have both MX and NS records same as > > example.com. Which may e.g. cause rejectd on backup MX hosts, apparently > > not designed to receive mail for www.exa

Re: A record of domain name must be name server ?

2014-09-11 Thread Sam Wilson
In article , Alan Clegg wrote: > On 9/10/14, 8:42 AM, Sam Wilson wrote: > > > And you could reduce maintenance very slightly by replacing > > > > www in A 75.100.245.133 > > > > with > > > > www in CN

Re: A record of domain name must be name server ?

2014-09-10 Thread Sam Wilson
In article , sch...@adi.com (Thomas Schulz) wrote: > > Hi, > > > > xxx.com and IP address 192.168.1.100 is just a example domain name and IP > > address. Our boss want everybody access our domain example.com through > > browser, then it will redirect to our web site www.example.com. So I want >

Re: BIND and listening on interfaces

2014-08-01 Thread Sam Wilson
In article , Reindl Harald wrote: > Am 01.08.2014 um 17:16 schrieb Barry Margolin: > > In article , > > Reindl Harald wrote: > > > >> the thread yesterday reminded me on my Fedora bugrpeort > >> https://bugzilla.redhat.com/show_bug.cgi?id=1073038#c3 > >> https://bugzilla.redhat.com/show_bug.c

Re: Default query type of dig

2014-06-25 Thread Sam Wilson
In article , Scott Bertilson wrote: > Don't know if you can control the default query type, but this is a RTFM > (see "man dig"): > > It is possible to set per-user defaults for dig via ${HOME}/.digrc. This > file is read and any options in it are applied before the command line > arguments. Y

Re: Point domain name of my zone to name in somebody else's zone?

2014-05-16 Thread Sam Wilson
In article , Kevin Darcy wrote: > On 5/9/2014 6:59 AM, Tony Finch wrote: > > Dave Warren wrote: > >> I actually think that MX records were a boneheaded thing to do, had email > >> started using SRV records in the first place we might be in a position now > >> where using SRV records is the defa

Re: Private & separate DNS domains

2014-04-08 Thread Sam Wilson
In article , Joseph S D Yao wrote: > On 2014-04-08 06:08, Bryan Harris wrote: > > ... > > The current mechanism is to put the Windows AD server into the > > resolv.conf BEFORE the BIND servers, since, as has been explained to > > me a Linux server will perform a query against all three > > simul

Re: High recursive client counts

2014-03-26 Thread Sam Wilson
In article , Jason Brandt wrote: > The code on our FWSMs isn't the latest release, so that could be part of > the issue, but it's been about 16 hours now since I shut it off, and so far > so good. I would say though with the other load on our firewalls, it's > highly possible that they were bei

Re: High recursive client counts

2014-03-26 Thread Sam Wilson
In article , Jason Brandt wrote: > For now, I've disabled DNS inspection on our firewall, as it is an ancient > Cisco firewall services module, and that seems to have stabilized things, > but it's only been 30 minutes or so. Until I get a few days in, I'll keep > researching. We used to run DN

Re: Can we do a sub-domain delegation with godaddy?

2014-01-16 Thread Sam Wilson
ess it's a delegation to a loadbalancer - a configuration we see plenty of examples of on this list. -- Sam Wilson Communications Infrastructure Section, IT Infrastructure Information Services, The University of Edinburgh Edinburgh, Scotland, UK -- The University of

Re: Can I have Inbound load balancing achieved with below settings

2013-11-15 Thread Sam Wilson
In article , Blake Hudson wrote: > Phil Mayers wrote the following on 11/14/2013 2:39 AM: > > I think there are better solutions than publishing an enormous list of > > A/ records, personally, and I think it's good that browser > > manufacturers aren't blasting out 6 SYNs every time someon

Re: Reverse address entries

2013-07-16 Thread Sam Wilson
In article , "Novosielski, Ryan" wrote: > Came across another instance where [reverse lookups] may matter: TCP Wrappers. > Although the case there was a bit more peculiar -- rr.net does not > appear to have FORWARD DNS for at least some of its dynamic address > space. So you can get a PTR, and t

Re: Reverse address entries

2013-07-12 Thread Sam Wilson
In article , Daniel McDonald wrote: > On 7/2/13 8:42 AM, "Sam Wilson" wrote: > > > There may be a subtle language thing going on here. I read the original > > post above as saying, literally, "you need PTR records because various > > software tries t

Re: Reverse address entries

2013-07-12 Thread Sam Wilson
In article , Steven Carr wrote: > On 2 July 2013 14:42, Sam Wilson wrote: > > Can anyone here give examples of the types of various software that will > > not operate without a PTR record? > > There have already been numerous listings of software that require > reverse

Re: Reverse address entries

2013-07-02 Thread Sam Wilson
nd PTR records match. > > >In article , > > Matus UHLAR - fantomas wrote: > >> He apparently meant exactly the same. Also calles FcRDNS - "forward > >> confirmed" or "full circle" reverse DNS. > > On 01.07.13 14:11, Sam Wilson wrote: > >

Re: configure syslog prefix

2013-07-02 Thread Sam Wilson
In article , Tony Finch wrote: > Klaus Darilion wrote: > > > > Some software allows to configure the syslog prefix, but I couldn't find > > that > > for bind. > > Rename the named executable. Assuming a Unix-like OS would having multiple links (hard or soft) have the correct effect? Sam -

Re: Reverse address entries

2013-07-01 Thread Sam Wilson
: > >> Certainly. Various software performs what's called a double-reverse > >> lookup > >> to confirm that the A and PTR records match. > > On 01.07.13 10:48, Sam Wilson wrote: > >Isn't that paranoid reverse lookup? Since reverse lookups can be f

Re: Reverse address entries

2013-07-01 Thread Sam Wilson
In article , Charles Swiger wrote: > On Jun 28, 2013, at 10:54 AM, "Ward, Mike S" wrote: > > Hello all, is there any reason to setup reverse address entries for a zone? > > Certainly. Various software performs what's called a double-reverse lookup > to confirm that the A and PTR records match

Re: Simple question about zone and CNAME

2013-04-24 Thread Sam Wilson
In article , Dave Sparro wrote: > On 4/6/2013 12:46 AM, Lawrence K. Chen, P.Eng. wrote: > > So, up until a couple years ago...our webmail address had always been, and > > only "webmail.ksu.edu". But, under the new directionit has to work as > > "webmail.ksu.edu", "www.webmail.ksu.edu", >

Re: Simple question about zone and CNAME

2013-04-24 Thread Sam Wilson
In article , Doug Barton wrote: > On 04/08/2013 06:54 AM, Sam Wilson wrote: > > In article , > > Doug Barton wrote: > >> On 04/05/2013 11:53 PM, Novosielski, Ryan wrote: > >> > >> | It is funny you should mention that... my questions about using vi

Re: Simple question about zone and CNAME

2013-04-24 Thread Sam Wilson
In article , Phil Mayers wrote: > On 04/08/2013 06:59 PM, Novosielski, Ryan wrote: > > > Someone can correct me if I'm wrong, but I think they'd be right if > > and only if the webserver they're adding the A record for happens to > > also be the AD server. > > In principle that's correct. > >

Re: Simple question about zone and CNAME

2013-04-24 Thread Sam Wilson
In article , "Barry S. Finkel" wrote: > On 4/8/2013 9:10 AM, bind-users-requ...@lists.isc.org wrote: > > In article , Phil > > Mayers wrote: > >> >Sam Wilson wrote: > >> > > >>> > >[adding an A record for ed.ac.uk.] > >

Re: Simple question about zone and CNAME

2013-04-24 Thread Sam Wilson
In article , Phil Mayers wrote: > On 08/04/13 14:46, Sam Wilson wrote: > > In article , > > Phil Mayers wrote: > > > >> Sam Wilson wrote: > >> > >>> [adding an A record for ed.ac.uk.] > >>> > >> > >> If y

Re: Simple question about zone and CNAME

2013-04-08 Thread Sam Wilson
In article , wbr...@e1b.org wrote: > Warren Kumari wrote on 04/05/2013 06:48:08 PM: > > > > And then there's theses folks: > > > > > > http://no-www.org/ > > > > > > > Oh wow! > > > > Gee, thanks for that? > > And it's always fun when you tell someone to go to a URL that doesn't > includ

Re: Simple question about zone and CNAME

2013-04-08 Thread Sam Wilson
In article , Doug Barton wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > > On 04/05/2013 11:53 PM, Novosielski, Ryan wrote: > > | It is funny you should mention that... my questions about using views > | to create a situation where one single record is different happens to > | be

Re: Simple question about zone and CNAME

2013-04-08 Thread Sam Wilson
In article , Phil Mayers wrote: > Sam Wilson wrote: > > > [adding an A record for ed.ac.uk.] > > > > If your AD realm is also called ed.ac.uk then adding an A record will > definitely affect things. Which is exactly the opposite of what our AD guys sai

Re: Simple question about zone and CNAME

2013-04-08 Thread Sam Wilson
In article , Dave Warren wrote: > On 2013-04-05 12:18, Sam Wilson wrote: > > We're currently prevaricating over putting in an A record for ed.ac.uk. > > Whilst my colleagues who manage active directory assure me that having > > an A record there - pointing at the conte

Re: Simple question about zone and CNAME

2013-04-08 Thread Sam Wilson
In article , wbr...@e1b.org wrote: > > >Incidentally, we have just been asked for an A record for cam.ac.uk to > > >duplicate www.cam.ac.uk because, and I quote, "all the publicity > material > > >sent out by the nominator [for an award for the web site] gave the URL > > >as http://cam.ac.uk/ an

Re: Simple question about zone and CNAME

2013-04-05 Thread Sam Wilson
In article , Chris Thompson wrote: > On Apr 5 2013, John Wobus wrote: > > >> DNAME? > > > >Or SRV records. Surely browsers are adding support > >in the next day or two? > > Come on, April 1 has been over for too long for this. > > Incidentally, we have just been asked for an A record for ca

Re: Delegations

2012-11-01 Thread Sam Wilson
In article , Jan-Piet Mens wrote: > > YPYMAYTYP > > Zero results from my favorite search engine -- congratulations. ;-) Thank you. Try YPYMAYTYC but I was thinking pick. Sam -- The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

Re: Delegations

2012-11-01 Thread Sam Wilson
In article , Mark Andrews wrote: > In message <5091adef.1040...@dougbarton.us>, Doug Barton writes: > > On 10/31/2012 03:56 PM, Mark Andrews wrote: > > > You are equating a practice that was techically wrong, and known > > > to be wrong from the get go, with one that has never been techically >

Re: Understanding cause of DNS format error (FORMERR)

2012-06-27 Thread Sam Wilson
In article , Barry Margolin wrote: > In article , > Sam Wilson wrote: > > > For a NXDOMAIN response, or NOERROR with an empty answer section, the > > server should provide the SOA record in the authority section. That SOA > > is the apex of the zone which doesn&

Re: Understanding cause of DNS format error (FORMERR)

2012-06-26 Thread Sam Wilson
In article , Gabriele Paggi wrote: > Hello Sam, > > > There's some kind of delegation bug as well.  If I query > > dns1[0-3].one.microsoft.com for SOA and NS for > > partners.extranet.microsoft.com you get sensible answers though the > > origin host is different for each server queried and thos

Re: Understanding cause of DNS format error (FORMERR)

2012-06-25 Thread Sam Wilson
In article , Tony Finch wrote: > It looks to me like this is an EDNS bug. ... There's some kind of delegation bug as well. If I query dns1[0-3].one.microsoft.com for SOA and NS for partners.extranet.microsoft.com you get sensible answers though the origin host is different for each server q

Re: Clarification on wildcard falls into glue records

2012-05-15 Thread Sam Wilson
In article , Tony Finch wrote: > Sam Wilson wrote: > > > > Is a name on the RHS of an RR regarded as existing enough to prevent > > wildcard lookup? > > No, only RR owner names. > > > In this I would have expected the NS lookup to be followed by an A &g

Re: Clarification on wildcard falls into glue records

2012-05-15 Thread Sam Wilson
In article , Alexander Gurvitz wrote: > You should NOT get A records. Wildcard works only for hostnames > that have NO records of ANY type. Excuse me while I delirk, but this is interesting. Is a name on the RHS of an RR regarded as existing enough to prevent wildcard lookup? In this I woul

Re: load-balancing in DNS using two A records

2011-12-21 Thread Sam Wilson
In article , Matus UHLAR - fantomas wrote: > On 20.12.11 19:37, Martin T wrote: > >I have seen setups where one domain name has two address records. > >First IP address is in the ISP-A network and the other one is in the > >ISP-B network. In case I execute "host www..com", I always > >get two IP

Re: Choosing max-journal-size

2011-11-30 Thread Sam Wilson
In article , Matus UHLAR - fantomas wrote: > >On 30/11/11 10:09, Matus UHLAR - fantomas wrote: > >>Well, that's way too much. The main point of journal is imho to provide > > On 30.11.11 11:51, Phil Mayers wrote: > >I think this is a decision for each operator to make themselves. > > I was try

Re: Help with dig to check NS servers for DNSSEC setup

2011-11-15 Thread Sam Wilson
In article , Mark Andrews wrote: > In message , Sam > Wilson writes: > > In article , > > Eduardo Bonsi wrote: > > > > > I am checking my DNS setup from inside using dig and I am getting > > > everything ok but I need a second opinion from outside

Re: Help with dig to check NS servers for DNSSEC setup

2011-11-15 Thread Sam Wilson
In article , Eduardo Bonsi wrote: > I am checking my DNS setup from inside using dig and I am getting > everything ok but I need a second opinion from outside of the server to > see if my ns1 and ns2 are responding ok to setup DNSSEC. Looks like you haven't put in any glue records for nsX.bon

Re: Clarification on CNAME

2011-01-26 Thread Sam Wilson
In article , Matus UHLAR - fantomas wrote: > On 24.01.11 17:13, rams wrote: > > y resolver is returning multiple CNAMEs for same hostname. But I believe > > CNAME should not return same hostname with multiple values. > > correct. > > > Is this behavior is correct. Could you please clarify me.

Re: Bind and blacklist IP file

2010-10-12 Thread Sam Wilson
In article , Alans wrote: > [ Norwegian Gov vs ISPs, banning domains, and inserting local host >entries to subvert such a ban ] > > Even this way, you should know all the IP of subdomains to work > properly. Try it for facebook, open homepage fine but once you login it > will fail. > Anoth

Re: non-24 bit subnets

2010-10-08 Thread Sam Wilson
In article , David Miller wrote: > You can have a different TTL for each and every record, if you like, in > the same zone file with no includes (the $TTL directive can appear > multiple times). > > e.g. : > > $TTL 300; 5 mins > *PTRhost-no-spec.example.com. > $TTL 3600; 1 ho

Re: zone syntax question

2010-07-20 Thread Sam Wilson
In article , Doug Barton wrote: > On Wed, 14 Jul 2010, Lyle Giese wrote: > > > I would replace example.com in the SOA with @ > > I generally recommend against doing this unless you are explicitly > planning to use the same zone file with multiple zones. There is no > advantage to using @ in

Re: problems resolving domains unser NSxx.DOMAINCONTROL.COM - this problem i have too! :(((((

2010-06-24 Thread Sam Wilson
In article , Mark Andrews wrote: > If it is not a local DPI problem then the only other thing > is that domaincontrol.com in using anycast and one or more > of the sites is using using nameservers that don't respond > to EDNS queries or has a firewall that blocks EDNS que

Re: IPv6 reverse zones advise

2010-05-10 Thread Sam Wilson
In article , Matthew Seaman wrote: > This means that the smallest chunk of IP space you can delegate is 16 > addresses, ... Nitpick: The smallest chunk of IPv6 space you can delegate is a single address, as you can for IPv4. You could also do RFC 2317 style delegations to delegate chunks of

Re: Master server offline

2010-05-10 Thread Sam Wilson
In article , Bruce Ray wrote: > You have until the expiry counter expires for a given zone. > > We typically run our expiries at a week to allow for this type of failure. Make them 10 days - that way you can break things on a Friday, have a week off and then fix them again on the Monday morni

Re: Switching to TCP in BIND.

2010-05-05 Thread Sam Wilson
In article , Stephane Bortzmeyer wrote: > On Wed, May 05, 2010 at 09:35:38AM +0100, > Sam Wilson wrote > a message of 22 lines which said: > > > > It seems (not tested by me) that Nominum CNS does that: when many > > > responses arrive which do not match

Re: Switching to TCP in BIND.

2010-05-05 Thread Sam Wilson
In article , sth...@nethelp.no wrote: > > > > I know of no such feature. What do you mean by "spoofed" anyway? How > > > > would you expect named to detect "spoofing", and is that its job? > > > > > > It seems (not tested by me) that Nominum CNS does that: when many > > > responses arrive which

Re: Switching to TCP in BIND.

2010-05-05 Thread Sam Wilson
In article , Stephane Bortzmeyer wrote: > On Wed, Apr 28, 2010 at 11:59:11AM -0400, > Kevin Darcy wrote > a message of 21 lines which said: > > > I know of no such feature. What do you mean by "spoofed" anyway? How > > would you expect named to detect "spoofing", and is that its job? > > I

Re: logging forwarding reqs

2010-04-16 Thread Sam Wilson
In article , Gregory Hicks wrote: > > Date: Thu, 15 Apr 2010 14:25:35 -0400 > > Subject: Re: logging forwarding reqs > > From: Jonathan Reed > > To: bind-users@lists.isc.org > > > > But I am still unable to determine if those reqs are asking the > > forwarders. > > > > The forwarders are all W

Re: Intermittent failures resolving .org domains in BIND 9.7.0 with DLV enabled

2010-03-30 Thread Sam Wilson
In article , Roy Badami wrote: > > I have seen this happen when bind for some reason (eg mtu issues with > > vpn) cannot query for the DLV key at dlv.isc.org. I have not figured > > out the exact failure mode there. Check the logs to see errors for DNSKEY > > queries for dlv.isc.org to see if th

Re: DNSSEC and child zones on same authoritative NS. Expert help needed.

2010-03-16 Thread Sam Wilson
In article , Gary Wallis wrote: > Sam Wilson wrote: > > In article , > > Gary Wallis wrote: > > > >> Let's say I have this setup : > >> > >> BIND 9.4 named.conf includes a master.zones file with the following: > >> > >> .

Re: DNSSEC and child zones on same authoritative NS. Expert help needed.

2010-03-16 Thread Sam Wilson
In article , Gary Wallis wrote: > Let's say I have this setup : > > BIND 9.4 named.conf includes a master.zones file with the following: > > ... > zone "ns1.yourdomain.com" { > type master; > file "master/external/n/ns1.yourdomain.com.signed"; >

Re: strange behaviour of resolving nameserver

2010-03-10 Thread Sam Wilson
In article , Mark Andrews wrote: > In message <20100309154017.4801c...@the-damian.de>, Torsten writes: > > Am Wed, 10 Mar 2010 00:44:46 +1100 > > schrieb Mark Andrews : > > > > > > > > In message <20100309142153.016c7...@the-damian.de>, Torsten writes: > > > > Hi, > > > > > > > > I'm a bit cl

Re: dnsquery for Solaris

2010-03-10 Thread Sam Wilson
In article , wrote: > dig was added to Solaris 9. It is not native to Solaris 8 or older. That would explain why it's only where Chris found it on some of our range of Solarises (vintage or only slightly worn). > Chris Thompson wrote: > > On Mar 9 2010,

Re: dnsquery for Solaris

2010-03-09 Thread Sam Wilson
In article , "ic.nssip" wrote: > I find it useful to test records cache time. dig tells you that. > I'll check on BIND 8 package. > Thank you for pointing to a Solaris compatible source. Use dig from a recent BIND package, though you may find it's already there - ours is in /usr/local/bin/

Re: OpenDNS today announced it has adopted DNSCurve to secure DNS

2010-02-25 Thread Sam Wilson
In article , Florian Weimer wrote: > * Sam Wilson: > > > Has anyone found any uz5* servers out there yet? > > node.pk, dempsky.org has such name servers. I thought there were > more. Has the magic prefix changed? OK. I found none in 130 MB of cache from 3 serve

Re: OpenDNS today announced it has adopted DNSCurve to secure DNS

2010-02-24 Thread Sam Wilson
In article , Chris Thompson wrote: > On Feb 24 2010, Evan Hunt wrote: > > >> Thats not the case with DNScurve. Again I stress - over 20 billion > >> requests per day at OpenDNS are DNScurve compatible. The traffic in > >> DNSSEC is chicken feed compared to DNScurve. > > > >ORG and GOV and quite

Re: Fwd: IPv6 client and negative cache - some doubts

2010-02-24 Thread Sam Wilson
In article , Mark Andrews wrote: > In message , > Micha > l Wesolowski writes: > > > > After some reading my present understanding is that correct response to > > > > query when there is such record in the zone and there exists another record > > of different type for the same name - is

Re: Fwd: IPv6 client and negative cache - some doubts

2010-02-24 Thread Sam Wilson
In article , Michal Wesolowski wrote: > My server is caching only, I don't administer ns*.az.pl servers. I'm just > trying to understand if binds copes well with such an external error. As you > pointed out both servers fails in some (different) way but second one does > this only when queried f

Re: no hostname become unresolvable.

2010-02-23 Thread Sam Wilson
In article , "Lightner, Jeff" wrote: > You need an A record for the domain itself: > superease.net. IN A 202.68.195.36 > www IN A 202.68.195.36 > > The first one (terminated by the dot) tells it lookup for the domain > name "superease.net" itself. The dot i

Re: IPv6 client and negative cache - some doubts

2010-02-23 Thread Sam Wilson
In article , Michal Wesolowski wrote: > Hello Everyone > > I have a problem with Bind 9.3.6-P1 (included in Solaris 10) but honestly I > don't even understand if it is wrong Bind behaviour or my ignorance. It does > apply only to some specific cases when external domain delegation is also > som

Re: Script to delete zone from named.conf

2010-02-05 Thread Sam Wilson
In article , Mark Andrews wrote: > Recent version of named-checkconf have a -p (print) option which > will emit named.conf, sans comments, in a consistent style which > will then be easy to post process. Shame about the "sans comments" - easy comprehension or easy management - take your pick.

Re: Parent is a CNAME

2009-12-02 Thread Sam Wilson
In article , Joseph S D Yao wrote: > On Wed, Dec 02, 2009 at 12:47:08PM +0000, Sam Wilson wrote: > > In article , > > Joseph S D Yao wrote: > [incorrectly] > > > No. > ... > > Not true. CNAME chains - CNAMEs pointing to other CNAMEs - are > > ineff

Re: Parent is a CNAME

2009-12-02 Thread Sam Wilson
In article , Joseph S D Yao wrote: > On Tue, Dec 01, 2009 at 04:59:16PM -0800, Hans Jacobsen wrote: > > If a.stanford.edu is a cname (say to b.stanford.edu) > > can I delegate subdomain.a.stanford.edu? Are there documents that > > point to this being an ok or bad practice? > > > > I know all

Re: zone vs domain

2009-12-02 Thread Sam Wilson
In article , Doug Barton wrote: > gmspro wrote: > > What's the main difference between zone and domain? > > In what context? Unfortunately both terms get used by various > people/vendors in different ways. A little more detail is needed to > answer your question (although if you're talking stri

Re: ** server can't find barcelonamedia.org.barcelonamedia.org: SERVFAIL

2009-11-06 Thread Sam Wilson
In article , Marc Riera wrote: > Now I have this on my named.conf.options to let me have underscores: > > check-names master ignore; > check-names slave ignore; Not a good plan. Those checks are in there for a reason, namely that underscores are invalid in host names. Whils

Re: 9.6.1-P1 zone parser false errors

2009-11-02 Thread Sam Wilson
In article , Chris Buxton wrote: > As I recall, named-checkzone calls out to the operating system stub > resolver to look up these names. Is there any way the stub resolver > could be getting different data? Is there anything in the stub > resolver config (/etc/{hosts,resolv.conf}) that mi

Re: Nslookup not showng TTL

2009-10-15 Thread Sam Wilson
In article , Kevin Darcy wrote: > (Fortunately nslookup's whole "won't do a lookup because I can't > reverse-resolve my resolver" bogosity isn't really an issue at Chrysler, > since we maintain proper reverse mappings, but that's another popular > "nslookup sucks, don't use it"-category posti

Re: Nslookup not showng TTL

2009-10-15 Thread Sam Wilson
ant. ... > ... It may, however, be better to introduce them > to dig rather than having to maintain the nslookup command. Do it. Use host if you have to but stay away from nslookup. Sam -- Sam Wilson one of hostmas...@ed.ac.uk Network Team, IT Infrastructure Information Serv

Re: Query Refused problem

2009-10-02 Thread Sam Wilson
In article , Michael Monnerie wrote: > On Freitag 02 Oktober 2009 Mark Andrews wrote: > > if (set(allow-query-cache)) > > use allow-query-cache; > > else if (set(allow-recursion)) > > use allow-recursion; > > else if (set(allow-query)) > >

Re: rndc command for erased zone?

2009-09-23 Thread Sam Wilson
In article , Matus UHLAR - fantomas wrote: > On 23.09.09 14:00, Marcos Lorenzo de Santiago wrote: > > I no longer manage one of our DNS domain. As I use 'rndc reconfig' to > > load newly created zones I was wondering if exists a way to do the same > > as reconfig but inversely, I mean, reload co

Re: Modified a zone, so when it becomes available?

2009-09-16 Thread Sam Wilson
In article , Marcos Lorenzo de Santiago wrote: > El mar, 15-09-2009 a las 13:45 +0200, Udo Zumdick escribió: > > Am Tue, 15 Sep 2009 12:28:24 +0200 > > schrieb Marcos Lorenzo de Santiago : > > > > [] > > > After making changes to zone, updated serial, and rndc reload, I dig my > > > zone a

Re: one DNS names to multiple IP Addresses(Round Robin DNS)

2009-09-14 Thread Sam Wilson
In article , Joseph S D Yao wrote: > On Wed, Sep 09, 2009 at 05:47:34PM +0100, Sam Wilson wrote: > > In article , > > Balanagaraju Munukutla <9ba...@sg.ibm.com> wrote: > > > Hi > > > > > > Anybody can help to explain the side effect of confi

Re: root and in-addr.arpa zone transfers

2009-09-11 Thread Sam Wilson
In article , Michael Monnerie wrote: > On Freitag 11 September 2009 Joseph S D Yao wrote: > > However, as M. Bortzmeyer has said, why do this? > > Faster queries after a named restart. ... How often do you restart named? We hit our master once a day, in the early hours but that's just habit

Re: one DNS names to multiple IP Addresses(Round Robin DNS)

2009-09-09 Thread Sam Wilson
In article , Balanagaraju Munukutla <9ba...@sg.ibm.com> wrote: > Hi > > Anybody can help to explain the side effect of configuring the DNS name to > multiple IP addresses(Round Robin DNS). If you're planning to use it for load sharing, then the effect is very basic - requests get shared equal

Re: Double messages in comp.protocols.dns.bind

2009-08-24 Thread Sam Wilson
In article , Barry Margolin wrote: > It looks like there are two mail-to-news gateways running for > bind-users, so every message to the list is being posted twice to the > newsgroup. ... But at least messages are now being posted to the newsgroup - the gatewaying, at least as seen from her

bind-users <-> comp.protocols.dns.bind stopped?

2009-07-02 Thread Sam Wilson
I note that the last posting in comp.protocols.dns.bind seems to have been on 4-Jun-09, both on my local news server and on Google Groups. I can't see any relevant announcements in the archive. What's happened? Sam ___ bind-users mailing list bind-us

Re: Delegation of DHCP blocks within same server?

2009-05-21 Thread Sam Wilson
In article , Matthew Pounsett wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > > On 20-May-2009, at 19:03, John Cole wrote: > > > For a concrete example: > > > > 10.0.0.0/16 is presently handled by a single zone file. > > 10.1.3.0/24 is DHCP issued > > 10.1.4.0/24 is DHCP issued

Re: two NS servers on a single host

2009-05-13 Thread Sam Wilson
In article , Bradley Giesbrecht wrote: > On May 13, 2009, at 6:51 AM, Stephane Bortzmeyer wrote: > > > On Wed, May 13, 2009 at 09:02:55PM +0800, > > Tech W. wrote > > a message of 34 lines which said: > > > >> I want to give two NS records for my domain, each NS take each of > >> the IP set in

Re: tcp versus udp

2009-05-07 Thread Sam Wilson
In article , Barry Margolin wrote: > In article , > Sam Wilson wrote: > > > In article , Mark Elkins > > wrote: > > > > > One place that TCP may make sense - if you are involved in a registry > > > system and the process involves actually chec

Re: tcp versus udp

2009-05-06 Thread Sam Wilson
In article , Mark Elkins wrote: > One place that TCP may make sense - if you are involved in a registry > system and the process involves actually checking the information that > you are given, including nameservers (do they exist, do they serve that > zone - correctly?) - it may make a lot of s

Re: tcp versus udp

2009-05-06 Thread Sam Wilson
In article , Danny Mayer wrote: > Peter Dambier wrote: > > Hello Martin, > > > > since a major outage at my provider, dtag.de or Deutsche Telecom AG, I have > > trouble > > with f.root-servers.net. Sometimes "dig ... +vc" does help me to see > > f.root-servers.net. > > > > The real problem i

Re: stop zone transfers from coming in

2009-04-30 Thread Sam Wilson
In article , Chris Henderson wrote: > My server works as a secondary for a zone. I asked the master server's > admin to stop the zone transfer; I didn't get any reply and thus > commented out the zone's section in my named.conf. But I'm still > getting zone files coming in to my server. > > Her

Re: Failover

2009-04-27 Thread Sam Wilson
In article , wrote: > This is not the DNS job to check at the web service availability. > You could make an external script that is testing for the service availibil= > ity > and change the dns accordingly, like (...) : > > web1 active ? > yes : was it active at last test ? > y

  1   2   >