Re: Troubleshooting DNSSEC issue w/ ic.fbi.gov

2013-07-18 Thread Casey Deccio
On Wed, Jul 17, 2013 at 10:58 AM, Bill Owens wrote: > This is one of the weirder ones I've seen. . . there are TXT and MX records > for ic.fbi.gov, both correctly signed: > > ... > However, that NSEC3 record is not signed. FWIW, DNSViz checks the chain of trust for authenticated denial-of-existe

Re: Troubleshooting DNSSEC issue w/ ic.fbi.gov

2013-07-18 Thread Barry S. Finkel
The SOA RNAME should work: fbi.gov.600INSOAns1.fbi.gov. dns-admin.fbi.gov. 2013071601 7200 3600 2592000 43200 In my years as a DNS administrator, about 50% of the time I tried to send e-mail to the SOA RNAME, that mail was returned as undeliverable. I never have trusted tha

Re: Troubleshooting DNSSEC issue w/ ic.fbi.gov

2013-07-18 Thread Phil Mayers
On 18/07/13 14:35, Barry S. Finkel wrote: The SOA RNAME should work: fbi.gov.600INSOAns1.fbi.gov. dns-admin.fbi.gov. 2013071601 7200 3600 2592000 43200 In my years as a DNS administrator, about 50% of the time I tried to send e-mail to the SOA RNAME, that mail was returned

RFC requirements for relative CNAME targets?

2013-07-18 Thread John Miller
Hey there folks, I know that for the following record in a zone file: host.example.com. -- John Miller Systems Engineer Brandeis University johnm...@brandeis.edu (781) 736-4619 ___ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsu

Re: RFC requirements for relative CNAME targets?

2013-07-18 Thread John Miller
My apologies--sent mid-message! I know that for the following record in example.com's zone file: host.example.com. IN CNAME otherhost BIND will return: host.example.com. IN CNAME otherhost.example.com. Is this behavior required anywhere in the RFCs, or would host.example.com. IN CNAME othe

Re: RFC requirements for relative CNAME targets?

2013-07-18 Thread Charles Swiger
On Jul 18, 2013, at 1:18 PM, John Miller wrote: > I know that for the following record in example.com's zone file: > > host.example.com. IN CNAME otherhost > > BIND will return: > > host.example.com. IN CNAME otherhost.example.com. Assuming $ORIGIN is set to example.com, but yes. > Is this

Re: RFC requirements for relative CNAME targets?

2013-07-18 Thread John Miller
On Thu, Jul 18, 2013 at 4:29 PM, Charles Swiger wrote: > On Jul 18, 2013, at 1:18 PM, John Miller wrote: > > I know that for the following record in example.com's zone file: > > > > host.example.com. IN CNAME otherhost > > > > BIND will return: > > > > host.example.com. IN CNAME otherhost.exam

Re: RFC requirements for relative CNAME targets?

2013-07-18 Thread Novosielski, Ryan
Are you asking if the target of a CNAME need be an FQDN if $ORIGIN is defined? If so, no, I use short names (no trailing dot) all the time. From: John Miller [mailto:johnm...@brandeis.edu] Sent: Thursday, July 18, 2013 05:49 PM To: Bind Users Mailing List Subject: Re: RFC requirements for relat

Re: RFC requirements for relative CNAME targets?

2013-07-18 Thread Barry Margolin
In article , John Miller wrote: > I think what I was getting at was whether appending $ORIGIN to an > unqualified target--only talking target, not label--was _required_ by the > RFCs, and if so, the RFC/section. I'll read through 'em; was just hoping > someone knew the answer off the top of the

Re: RFC requirements for relative CNAME targets?

2013-07-18 Thread John Levine
>I think what I was getting at was whether appending $ORIGIN to an >unqualified target--only talking target, not label--was _required_ by the >RFCs, and if so, the RFC/section. I'll read through 'em; was just hoping >someone knew the answer off the top of their head. RFC 1034, page 34. R's, John

Re: RFC requirements for relative CNAME targets?

2013-07-18 Thread John Miller
On 07/18/2013 06:07 PM, Barry Margolin wrote: In article , John Miller wrote: I think what I was getting at was whether appending $ORIGIN to an unqualified target--only talking target, not label--was _required_ by the RFCs, and if so, the RFC/section. I'll read through 'em; was just hoping

Re: RFC requirements for relative CNAME targets?

2013-07-18 Thread John Miller
Hi Ryan, Sorry I wasn't more clear in my original post. Barry hit the nail on the head: I was curious if the RFCs required BIND to append $ORIGIN to targets that aren't fully qualified. Sounds like they do. I appreciate the help! John On 07/18/2013 05:59 PM, Novosielski, Ryan wrote: A

Re: RFC requirements for relative CNAME targets?

2013-07-18 Thread John Miller
On 07/18/2013 06:07 PM, Barry Margolin wrote: In article , John Miller wrote: I think what I was getting at was whether appending $ORIGIN to an unqualified target--only talking target, not label--was _required_ by the RFCs, and if so, the RFC/section. I'll read through 'em; was just hoping