RE: Enforce EDNS

2017-02-08 Thread Michael Hare
-Michael > -Original Message- > From: bind-users [mailto:bind-users-boun...@lists.isc.org] On Behalf Of Mark > Andrews > Sent: Tuesday, February 07, 2017 4:32 PM > To: Reindl Harald > Cc: bind-us...@isc.org > Subject: Re: Enforce EDNS > > > In message <4b0243b

Re: Enforce EDNS

2017-02-07 Thread Mark Andrews
In message <4b0243b1-1c89-023b-f3f3-7279216d5...@thelounge.net>, Reindl Harald writes: > > > Am 07.02.2017 um 22:11 schrieb Mark Andrews: > > In message <3836f038-c480-9970-fd53-a5c87ad36...@thelounge.net>, Reindl Har > ald wr > > ites: > >>> Break them. That's the only way it will eventually

Re: Enforce EDNS

2017-02-07 Thread Alan Clegg
On 2/7/17 3:11 PM, Mark Andrews wrote: >>> Break them. That's the only way it will eventually get fixed >> >> if things would be that easy >> >> the admins of the broken servers ar the very last which are affected, >> admins with a recent named have to bite the bullet of user terror and >>

Re: Enforce EDNS

2017-02-07 Thread Reindl Harald
Am 07.02.2017 um 22:11 schrieb Mark Andrews: In message <3836f038-c480-9970-fd53-a5c87ad36...@thelounge.net>, Reindl Harald wr ites: Break them. That's the only way it will eventually get fixed if things would be that easy the admins of the broken servers ar the very last which are af

Re: Enforce EDNS

2017-02-07 Thread Mark Andrews
In message <3836f038-c480-9970-fd53-a5c87ad36...@thelounge.net>, Reindl Harald wr ites: > > > Am 07.02.2017 um 18:13 schrieb Chuck Anderson: > > On Tue, Feb 07, 2017 at 11:59:39AM +1100, Mark Andrews wrote: > >> I really don't want to add new automatic work arounds for broken > >> servers but i

Re: Enforce EDNS

2017-02-07 Thread wbrown
From: Matthew Pounsett > I fully support breaking resolution for such servers. I'd rather > have a hard failure on my end that I can investigate, and work > around if necessary, than have my server wasting cycles trying to > guess what sort of broken state there is on the far end. It would

Re: Enforce EDNS

2017-02-07 Thread Reindl Harald
Am 07.02.2017 um 18:13 schrieb Chuck Anderson: On Tue, Feb 07, 2017 at 11:59:39AM +1100, Mark Andrews wrote: I really don't want to add new automatic work arounds for broken servers but it requires people being willing to accepting that lookups will fail. That manual work arounds will now hav

Re: Enforce EDNS

2017-02-07 Thread Matthew Pounsett
On 6 February 2017 at 19:59, Mark Andrews wrote: > > Unfortunately we then need to decide what to do with servers that > don't answer EDNS + DNS COOKIE queries. Currently we fall back to > plain DNS which works except when there is a signed zone involved > and the server is validating. > > I rea

Re: Enforce EDNS

2017-02-07 Thread Chuck Anderson
On Tue, Feb 07, 2017 at 11:59:39AM +1100, Mark Andrews wrote: > I really don't want to add new automatic work arounds for broken > servers but it requires people being willing to accepting that > lookups will fail. That manual work arounds will now have to > be done. e.g. "server ... { send-cookie

Re: Enforce EDNS

2017-02-07 Thread Matus UHLAR - fantomas
validate. Subsequent queries towards this upstream name server were not utilizing EDNS as well because named remembers a name servers capabilities for some time (See also https://deepthought.isc.org/article/AA-00510/0) My question is, can I enforce EDNS usage for a name server? I was thinking of the

Re: Enforce EDNS

2017-02-07 Thread G.W. Haywood
Hi there, On Tue, 7 Feb 2017, Mark Andrews wrote: I really don't want to add new automatic work arounds for broken servers but it requires people being willing to accepting that lookups will fail. That manual work arounds will now have to be done. e.g. "server ... { send-cookie no; };" +2 -

Re: Enforce EDNS

2017-02-07 Thread Daniel Stirnimann
> Named doesn't have a switch to force EDNS though I suppose we could > add one to 9.12. e.g. server ... { edns force; }; I would find this useful. > I really don't want to add new automatic work arounds for broken > servers but it requires people being willing to accepting that > lookups will f

Re: Enforce EDNS

2017-02-06 Thread Mark Andrews
the query response failed to validate. Subsequent queries towards this > upstream name server were not utilizing EDNS as well because named > remembers a name servers capabilities for some time (See also > https://deepthought.isc.org/article/AA-00510/0) > > My question is, can I enforc

Enforce EDNS

2017-01-31 Thread Daniel Stirnimann
upstream name server were not utilizing EDNS as well because named remembers a name servers capabilities for some time (See also https://deepthought.isc.org/article/AA-00510/0) My question is, can I enforce EDNS usage for a name server? I was thinking of the 'edns' clause in the server s