Re: Synthesized CNAME from NXDOMAIN

2013-10-04 Thread Barry Margolin
In article , Casey Deccio wrote: > On Thu, Oct 3, 2013 at 2:54 PM, Paul Wouters wrote: > > > You are why we can't have nice things :P > > > > We had enough Sitewinders. With DNSSEC on the endnode, your lies won't > > be believed anway. What you are trying is wrong, bad and broken. > > > > > Th

Re: Synthesized CNAME from NXDOMAIN

2013-10-03 Thread Casey Deccio
On Thu, Oct 3, 2013 at 5:52 PM, Mark Andrews wrote: > Then I suggest that you just add CNAMEs whenever you remove other record. > Once a part of the namespace only have CNAME/DNAME below it replace it > with a DNAME. You will converge on the earlier example. > Thanks - I'll start there. Casey

Re: Synthesized CNAME from NXDOMAIN

2013-10-03 Thread Mark Andrews
In message , Casey Deccio writes: > > On Thu, Oct 3, 2013 at 5:42 PM, Mark Andrews wrote: > > > > > Use a DNAME record. That works with DNSSEC. > > > > > Thanks for the suggestion. I would use DNAME, except the old namespace > will still have names under it, and names are not allowed to exi

Re: Synthesized CNAME from NXDOMAIN

2013-10-03 Thread Casey Deccio
On Thu, Oct 3, 2013 at 5:42 PM, Mark Andrews wrote: > > Use a DNAME record. That works with DNSSEC. > > Thanks for the suggestion. I would use DNAME, except the old namespace will still have names under it, and names are not allowed to exist below a DNAME. In other words, we're not replacing t

Re: Synthesized CNAME from NXDOMAIN

2013-10-03 Thread Mark Andrews
Use a DNAME record. That works with DNSSEC. e.g. oldzone.com SOA . oldzone.com NSns1.newzone.com oldzone.com NSns2.newzone.com oldzone.com MX0 mail.newzone.com oldzone.com A ... oldzone.com ... oldzone.com DNAME

Re: Synthesized CNAME from NXDOMAIN

2013-10-03 Thread Casey Deccio
On Thu, Oct 3, 2013 at 2:54 PM, Paul Wouters wrote: > You are why we can't have nice things :P > > We had enough Sitewinders. With DNSSEC on the endnode, your lies won't > be believed anway. What you are trying is wrong, bad and broken. > > This might be a fair statement in the right context. Bu

Re: Synthesized CNAME from NXDOMAIN

2013-10-03 Thread Paul Wouters
On Thu, 3 Oct 2013, Casey Deccio wrote: I would like to apply something similar to a "redirect" zone (for NXDOMAIN responses) You are why we can't have nice things :P We had enough Sitewinders. With DNSSEC on the endnode, your lies won't be believed anway. What you are trying is wrong, bad a

Synthesized CNAME from NXDOMAIN

2013-10-03 Thread Casey Deccio
Hi all, I'm looking to get RPZ-like behavior in a non-RPZ context. From the BIND9 ARM (9.9.4), this is a snippet from an RPZ zone: ; redirect x.bzone.domain.com to x.bzone.domain.com.garden.example.com *.bzone.domain.com CNAME *.garden.example.com. I would like to apply something similar