Re: Single nameserver doesn't show signed SOA-RRs

2011-06-30 Thread Stefan Foerster
* Mark Andrews : > In message <20110630031511.gn14...@mail.incertum.net>, Stefan Foerster writes: > > * Mark Andrews : > > > Contact the adminstrator of the server and request that they stop > > > disabling dnssec. "dnssec-enable yes;" is the default for all > > > version except 9.3.x. > > > > Ar

RE: Single nameserver doesn't show signed SOA-RRs

2011-06-29 Thread Marc Lampo
+ / let me guess / you use Smart Signing ? Weird, this week, in my verification of DNSSEC'd domains by our registrars I picked up exactly the same error : no RRSIG on the SOA. They filed a bug report to ISC about this. Might be related to this Smart Signing thing - can you confirm you are also us

Re: Single nameserver doesn't show signed SOA-RRs

2011-06-29 Thread Mark Andrews
In message <20110630031511.gn14...@mail.incertum.net>, Stefan Foerster writes: > * Mark Andrews : > > Contact the adminstrator of the server and request that they stop > > disabling dnssec. "dnssec-enable yes;" is the default for all > > version except 9.3.x. > > Are you sure that 88.198.26.233

Re: Single nameserver doesn't show signed SOA-RRs

2011-06-29 Thread Stefan Foerster
* Mark Andrews : > Contact the adminstrator of the server and request that they stop > disabling dnssec. "dnssec-enable yes;" is the default for all > version except 9.3.x. Are you sure that 88.198.26.233 has DNSSEC disabled? The admin told me he had added "dnssec-enable yes;" to the named.conf f

Re: Single nameserver doesn't show signed SOA-RRs

2011-06-29 Thread Mark Andrews
Contact the adminstrator of the server and request that they stop disabling dnssec. "dnssec-enable yes;" is the default for all version except 9.3.x. % grep dnssec-enable 9.?.x/bin/named/config.c 9.3.x/bin/named/config.c: dnssec-enable no; /* Make yes for 9.4. */ \n\ 9.4.x/bin/named/config

Re: Single nameserver doesn't show signed SOA-RRs

2011-06-29 Thread Zenon Panoussis
On 06/29/2011 10:57 PM, Stefan Foerster wrote: > ...it complains that ns3.wars-nicht.de doesn't have a > signed SOA. It complains that the SOA of wars-nicht.de itself is not signed, or that ns3.wars-nicht.de does not have a signed SOA for billigmail.org and incertum.net? > I already tried incr