Re: Querying directly a nameserver works, while forwarding not

2012-12-06 Thread Mark Andrews
In message , Daniele Imbrogino writes: > I'm testing new configuration on VirtualBox following the advice of not > forwarding. > Furthermore, I exclude any reference to DNSSEC. > > So, in these conditions and assuming an empty cache, if I query for a > remote domain name, my server should query

Re: Querying directly a nameserver works, while forwarding not

2012-12-06 Thread Sten Carlsen
My next move would be to look for issues in the network, I would look at what wireshark can sniff out. I would look for packets with errors. The purpose is to find out if the network is mangling packets. On 06/12/12 16:46, Daniele Imbrogino wrote: > I'm testing new configuration on VirtualBox fol

Re: Querying directly a nameserver works, while forwarding not

2012-12-06 Thread Daniele Imbrogino
I'm testing new configuration on VirtualBox following the advice of not forwarding. Furthermore, I exclude any reference to DNSSEC. So, in these conditions and assuming an empty cache, if I query for a remote domain name, my server should query a root-server and then iterate, right? Well, Wireshar

Re: Querying directly a nameserver works, while forwarding not

2012-12-05 Thread Sten Carlsen
On 05/12/12 18:29, Hauke Lampe wrote: On 05.12.2012 14:59, Daniele Imbrogino wrote: resolv.conf contains only 127.0.0.1 as nameserver. The syslog contains a lot of errors as "insecurity proof failed", "no valid RRSIG", "got insecure response" that I don't understand. Your forwarder probab

Re: Querying directly a nameserver works, while forwarding not

2012-12-05 Thread Hauke Lampe
On 05.12.2012 14:59, Daniele Imbrogino wrote: resolv.conf contains only 127.0.0.1 as nameserver. The syslog contains a lot of errors as "insecurity proof failed", "no valid RRSIG", "got insecure response" that I don't understand. Your forwarder probably doesn't handle DNSSEC responses well. T

Re: Querying directly a nameserver works, while forwarding not

2012-12-05 Thread Daniele Imbrogino
resolv.conf contains only 127.0.0.1 as nameserver. The syslog contains a lot of errors as "insecurity proof failed", "no valid RRSIG", "got insecure response" that I don't understand. ___ Please visit https://lists.isc.org/mailman/listinfo/bind-users to

Re: Querying directly a nameserver works, while forwarding not

2012-12-05 Thread Matus UHLAR - fantomas
On Wed, 2012-12-05 at 10:23 +0100, Daniele Imbrogino wrote: /etc/bind/named.conf.option On 05.12.12 21:47, Noel Butler wrote: WTF is that file? it certainly is not an ISC named file. It's file containing the options section, installed by default in debian. From the changelog: * Do option

Re: Querying directly a nameserver works, while forwarding not

2012-12-05 Thread Hauke Lampe
On 05.12.2012 10:23, Daniele Imbrogino wrote: I restarted BIND9 and then I tried, for example, 'dig www.apple.com' obtaining "connection timed out; no servers could be reached". But if I try 'dig @10.0.2.3 www.apple.com' it works correctly and I obtain the correct answer. Why? How can I resolve

Re: Querying directly a nameserver works, while forwarding not

2012-12-05 Thread Noel Butler
On Wed, 2012-12-05 at 10:23 +0100, Daniele Imbrogino wrote: > /etc/bind/named.conf.option WTF is that file? it certainly is not an ISC named file. if you are using some butchered to buggery distros file, please ask on your distros mailing list we are not to know what that file contains, or exp