How to configure minimal-responses option at zone level?

2019-10-23 Thread rams
Hi, Greetings ! How to configure "minimal-responses" option at zone level? At global level it is working fine. but looking help for zone level to configure. Can someone help me on this Regards, Ramesh ___ Please visit https://lists.isc.org/mailman/li

Re: How to configure minimal-responses option at zone level?

2019-10-23 Thread Tony Finch
rams wrote: > How to configure "minimal-responses" option at zone level? You can only configure it per view or in the global options. The named.conf(5) man page lists all the options and where they can appear. It is generated from the configuration file parsing code so you can trust its correct

Internal CNAME in RPZ

2019-10-23 Thread Andrey Geyn
Hello, I would like to set up RPZ with CNAME and A. There are two options: 1.cname.domain.com        CNAME   test.domain.com    (without trailing dot)test.domain.com         A       10.10.10.10 In this case I receive # dig cname.domain.com @127.0.0.1...cname.domain.com.       5       IN      CNAME

Re: Internal CNAME in RPZ

2019-10-23 Thread Андрей Гейн
// Sorry for HTML embedded to my first email. Hello, I would like to set up RPZ with CNAME and A. There are two options: 1. cname.domain.comCNAME test.domain.com(without trailing dot) test.domain.com A 10.10.10.10 In this case I receive # dig cname.domain.com @12

Re: Internal CNAME in RPZ

2019-10-23 Thread m3047
Hi, so Andrey, Your output doesn't reflect what I would expect to see from an RPZ-mediated query, but rather what I would expect to see if querying a zone, such as the RPZ itself, directly. So I am not sure I understand your question. To the broader ISC community: however, I'm confused by th

Re: Internal CNAME in RPZ

2019-10-23 Thread Andrey Geyn
Hi, Fred! Thank for your reply and tests. The questions you ask are my questions too, just asked more professionally. Thanks for it :) Okay, let's use only variant with trailing dot, thank you for clarification. I don't understand why your tests for "cname.example.com" and "cname.test.m3047.n

Re: Internal CNAME in RPZ

2019-10-23 Thread julien soula
On Wed, Oct 23, 2019 at 10:21:08PM +0500, Andrey Geyn wrote: > Hi, Fred! > > Thank for your reply and tests. > The questions you ask are my questions too, just asked more professionally. > Thanks for it :) > > .../... > In my test (I have BIND 9.11.3-1ubuntu1.9-Ubuntu) I have following named.c

Re: Internal CNAME in RPZ

2019-10-23 Thread m3047
Hello... On Wed, 23 Oct 2019, Andrey Geyn wrote: [...] I don't understand why your tests for "cname.example.com" and "cname.test.m3047.net" differ (first one returns only CNAME.EXAMPLE.COM. 5 IN CNAME TEST.EXAMPLE.COM. I didn't understand this as well. Is it something about caching perhaps?

Re: Internal CNAME in RPZ

2019-10-23 Thread m3047
Eh? I don't understand this. Response Policy Zones are /zones/, as the nomenclature implies: they are maintained, transferred, managed with zone handling machinery. On Wed, 23 Oct 2019, julien soula wrote: On Wed, Oct 23, 2019 at 10:21:08PM +0500, Andrey Geyn wrote: In my test (I have BIND

Re: Bind-Efficientip

2019-10-23 Thread Mik J via bind-users
Hello, Efficient IP uses bind (+ nsd/unbound) as the DNS server. One major difference between Efficient IP and bind is when you want to delegate the zone configuration to users and groups. I think it's called role based management.So let's say you want team1 to have read/write access to the zone

Re: Bind-Efficientip

2019-10-23 Thread Reindl Harald
Am 24.10.19 um 00:35 schrieb Mik J via bind-users: > Efficient IP uses bind (+ nsd/unbound) as the DNS server. > > One major difference between Efficient IP and bind is when you want to > delegate the zone configuration to users and groups. I think it's called > role based management. > So let's

Re: Bind-Efficientip

2019-10-23 Thread Mik J via bind-users
You won't do it within a night that's for sure.But yes the vendors assemble components with a web interface and database.But now it seems to me that all products add more intelligence. For my own needs bind alone is all fine because I'm root.But for 500+ users that need to view, modify some zon

RPZ behavior for authoritative servers

2019-10-23 Thread Mik J via bind-users
Hello, I know that the RPZ functionality aims to block/redirect/log DNS queries from the inner network. What about the authoritative DNS facing the Internet ? I receive some spam, I get probed on my webservers etc.Many of these annoiyances start with a DNS query. What is mydomain.org ? My DNS ans

Re: Bind-Efficientip

2019-10-23 Thread Reindl Harald
Am 24.10.19 um 00:53 schrieb Mik J: > You won't do it within a night that's for sure add the delegation part for who can show and edit which zones? easily given that the whole backend was written basicly in a single night after the day we decided to move all dns zones from customers to our own

Re: RPZ behavior for authoritative servers

2019-10-23 Thread Chuck Aurora
On 2019-10-23 18:14, Mik J via bind-users wrote: Hi, I know that the RPZ functionality aims to block/redirect/log DNS queries from the inner network. What about the authoritative DNS facing the Internet ? I receive some spam, I get probed on my webservers etc. Many of these annoiyances start w