Re: Case For Microsoft DNS v. BIND 9 - Or Best Practices For Coexisting

Microsoft DNS can work well, HOWEVER much time needs to be spent understanding its operations. This is a VERY long winded post, so I hope no one gets upset, I realize this is not the MS DNS group LOL I am going to assume, that you are running an Active Directory Domain that includes thes

Re: Multiple BIND instances

suggesting this is what you should do, but rather showing it has been a very successful and cost effective solution for me. You should evaluate the expected DNS load and test accordingly. I tested my servers with several times our current

9.9.4 Bug Fixes - RT #34583

Good morning/day/evening. What exactly does "beneath" mean in the following line from the 9.9.4 bug fixes? "Fix forwarding for forward only "zones" beneath automatic empty zones. [RT #34583]" Thanks in advance, Steve.

DNS passthrough on no explicit result?

is setup, and am having a hard time searching for it because of that. (So I apologize if this is then a dumb question). Any help you can offer is much appreciated. Thanks! Steve ___ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscr

Re: DNS passthrough on no explicit result?

Carl, Sten, Thanks! That's exactly what I was looking for. Steve On Jan 31, 2014 12:10 PM, "Sten Carlsen" wrote: > I can add that this is what I do to solve the same problem. > > I have one difference that you may consider: > I am a stealth master for my external zone,

Why two lookups for a CNAME?

ay.l.google.com. When asked to resolve it, named will first look for play.google.com. The result will include the CNAME and the IP of the A record. Named then makes a second request to resolve the A record. Thanks in advance, Steve.___ Ple

RE: Why two lookups for a CNAME?

Thank you Jeff. I was just wondering why, when the IP comes back with the first response, does named ask again? Is it just being literal (like me) or will it not always get the IP in the first request (depending on the DNS server)? Steve. > On October 21, 2015 at 3:42 PM "Lightn

Re: Why two lookups for a CNAME?

Makes sense. Better safe than sorry. Thanks, Steve. > > On October 21, 2015 at 4:01 PM Mark Andrews wrote: > > > > To prevent cache poisoning via cnames. It it simpler to always > lookup the target of the cname that to figure out if we would >

Re: Why two lookups for a CNAME?

uest and receives one reply. The test was for "play.google.com". If anyone has suggestions, please toss them my way. "Let it work as designed and deal with it" or similar comments will be graciously accepted. Thanks again, Steve. > > On October 22, 2015

Re: Why two lookups for a CNAME?

CNAMES (as we see them in logs). I will share the options and suggestions to those who decide. (sorry for the TOFU) Steve. ___ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users

Vim Syntax, New Release for ISC Bind named.conf 5.16

Hello, Bind-Users, This is my 2nd post (in 19 years). I'm announcing the release of ISC Bind v9.16 named.conf syntax file for Vim editor. Yeah, the last one is the Vim stock 'named.conf' syntax and probably works marginally today as it was written for Bind 9.4-9.5. No auto-installer yet.

Re: Vim Syntax, New Release for ISC Bind named.conf 5.16

I haven't worked on the zone syntax file yet. It hasn't changed since v9.5 days. That should be my next subproject. (Which should go by rather quickly given that I've a mastery on Vim syntax, I hope). S. On 4/22/20 2:50 PM, Hugo Salgado wrote: Thanks a lot Steve, works lik

Re: Vim Syntax, New Release for ISC Bind named.conf 5.16

I'm slowly working on a dialog with the Vim maintainer. But before I do that "final" submission, it would make sense to vet this a bit more solidly before I 'mainstream' this. On 4/22/20 3:25 PM, Evan Hunt wrote: On Wed, Apr 22, 2020 at 02:32:51PM -0400, Steve Egbe

Re: bind-users Digest, Vol 3427, Issue 1

On 4/23/20 3:39 AM, bind-users-requ...@lists.isc.org wrote: Where would you like bug reports sent to? GitHub, your email, elsewhere? Site: https://github.com/egberts/vim-syntax-bind-named Issue: https://github.com/egberts/vim-syntax-bind-named/issues ```bash git clone https://github.com/egbe

delv isc_app_ctxsuspend ctx->running ASSERTION

Assertion in `delv` utility. Had an assertion error for `delv` utility in trying to perform suspend thread. Doesn't seem specific to any thing, argument-wise. Environment: Linux 4.19 Debian 10.3 Custom built Bind v9.17.1 bind9/lib/isc/app.c:422 void isc_app_ctxsuspend(isc_appctx_t *ctx) {

Re: delv isc_app_ctxsuspend ctx->running ASSERTION

Had an assertion error for `delv` utility in trying to perform suspend thread. Doesn't seem specific to any thing, argument-wise. Environment: Linux 4.19 Debian 10.3 Custom built Bind v9.17.1 bind9/lib/isc/app.c:422 void isc_app_ctxsuspend(isc_appctx_t *ctx) { REQUIRE(VALID_APPCTX(ctx));

Re: delv isc_app_ctxsuspend ctx->running ASSERTION

Had an assertion error for `delv` utility in trying to perform suspend thread. Doesn't seem specific to any thing, argument-wise. This is weird. `*ctx->running` is set to `true`. It would have continued on normally to suspending the thread, if it weren't for that `REQUIRE(VALID_APPCTX(ctx)

Zone not showing us as authority

authority as well as the zone file contents on our dns server 69.25.129.117. Thanks, Steve = C:\DNS\Dig>dig @4.2.2.1 discoversunriver.com ns ; <<>> DiG 9.5.0-P2 <<>> @4.2.2.1 discoversunriver.com ns ; (1 serve

Zone does not show an A record when using Dig

I have one of my zones that is not showing one of the A records when using Dig anyone know why this is happening? emailclickA 64.186.224.244 Thanks, Steve === Zone file content on secondary $ORIGIN . $TTL 900

Zone not propogating to slaves

zones. By the way until this zone I have not had problems with zones coming across to either slave although I have had to do a recycle to the .117 to get them there. Anyone know why I am getting this "not authoritative" message and no zone file on .118 all of a sudden? Than

RE: Zone not propogating to slaves

Ah, Thanks for pointing out my errors. :) Steve -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Niall O'Reilly Sent: Thursday, November 20, 2008 3:45 PM To: BIND Users Mailing List Subject: Re: Zone not propogating to slaves On Wed, 2008-11-19 at

named-checkconf error

I'm running BIND 9.4.2 on OpenBSD 4.3. I'm getting some errors with named-checkconf I don't really understand. I'm running: named-checkzone -t /var/named capmarksecurities.com /master/db.capmarksecurities.com and I get: zone capmarksecurities.com/IN: getaddrinfo(quarantine1.capmark.com) f

Re: BIND Security Advisory (CVE-2009-0025; Severity: Low)

On 1/8/2009 9:10 AM, David Coulthart wrote: Would someone be able to provide some more details as to what particular configurations of BIND this affects? My interpretation is it only impacts recursive nameservers that have DNSSEC validation enabled. Speaking in terms of BIND config options, the d

Multiple CNAME alternantive?

want to avoid using configuration exceptions and multiple CNAMEs. Does anyone have a "clean" alternative? Thanks, Steve. ___ bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users

Re: named won't restart

o what you see in the process table. If you stop bind and restart it with the init script the PID should match and "restart" should work after that. Steve. On Fri, 2010-11-12 at 14:00 +0200, Bèrto ëd Sèra wrote: > maybe this can be of help: > http://bugs.gentoo.org/show_bu

Re: bind replication

he zone data at the remote site is pretty fresh. One downside to rsync is having to be aware of when the scheduled synchronization occurs. One must be careful when editing zone files or changing configurations so that partial changes are not copied to the remote systems which could cause problem

Re: transfer with views

make sure they are correct? If the configuration isn't correct, the same zone can be transferred to multiple views. If you are successfully transferring multiple views, can you post the slave configuration? Is the slave using the correct key in the third view? Steve. On Sat, 2011-01-01 at

bind slave not get DNS update

and would probably // also be included in the "localhost_resolver" view above : zone " mydomain.com" { type slave; file "slaves/ mydomain.com.zone"; masters { /* put master nameserver IPs here */ A.A.A.A; } ; }; }; Thanks, Steve ___ bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users

RE: bind slave not get DNS update

Do u mean rndc? I do have it running: tcp0 0 127.0.0.1:953 0.0.0.0:* LISTEN 8341/named Steve From: Paul Ooi Cong Jen [mailto:paul...@takizo.com] Sent: Tuesday, January 04, 2011 5:11 PM To: Steve Zeng Cc: bind-users@lists.isc.org Subject: Re

RE: bind slave not get DNS update

ave(windows DNS) C.C.C.C;# public IP of second DNS slave(Linux BIND DNS) }; Thanks, Steve -Original Message- From: bind-users-bounces+stevez=airg@lists.isc.org [mailto:bind-users-bounces+stevez=airg@lists.isc.org] On Behalf Of R

RE: bind slave not get DNS update

Rndc transfer (initialized at the slave side) works fine... Steve -Original Message- From: Paul Ooi Cong Jen [mailto:paul...@takizo.com] Sent: Tuesday, January 04, 2011 6:01 PM To: Steve Zeng Cc: Robert Spangler; bind-users@lists.isc.org Subject: Re: bind slave not get DNS update

RE: bind slave not get DNS update

fy out but refused by BIND slave also-notify { B.B.B.B;# public IP of first DNS slave(windows DNS) C.C.C.C;# public IP of second DNS slave(Linux BIND DNS) }; Steve -Original Message- From: bind-users-bounces+s

RE: bind slave not get DNS update

On slave, it sees the public IPs. tcpdump shows: 01:38:51.035945 IP A.A.A.A.domain > C.C.C.C.domain: 7545 notify [b2&3=0x2400] [1a] SOA? airg.com. (72) 01:38:51.036174 IP C.C.C.C.domain > A.A.A.A.domain: 7545 notify Refused- 0/0/0 (26) Steve -Original Message- From: Ma

Re: multi-master with mysql backend

ch is the master in the main location. If the first master disappears, the slaves will use the other master. Simplicity is important to me as well and that's why I chose rsync to periodically get the zone data (and configs) to the master in the secondary location. I looked into MySQL

Re: Slaves and views

the zone in both views if you make any changes to it. Again, it is a bad idea and I think ISC recommends against it. > I'm not (yet) worried about dynamic updates, if there are > any. That will not work. You will need separate files for each view. Steve. _

Re: Problems in views in a zone transfer

u must specifically block from those views and allow them later in a other view. Increasing log levels and viewing logs will tell you what's going on. Good luck, Steve. Assuming 192.168.100.5 is your master and 192.168.100.10 and 192.168.100.20 are your slaves: ---

please remove me from this mail list

Steve Ingraham Director of Information Systems Oklahoma Court of Criminal Appeals mailto:singra...@okcca.net 405 522-5343 (office) 405 822-0621 (cell) ___ bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind

Re: Max number of views and performance.

It is my experience the client hits the views in order (top, down) until an ACL allows it. Once an ACL allows it in a view, it goes no further. Steve. On Wed, 2011-08-24 at 10:32 -0300, sky shade wrote: > Someone know how bind test client matches? I know that its respect the > decla

Re: dnssec question. confused.

Is your firewall Cisco based? There is a known "default" setting in Cisco with respect to packet size for DNS. Our network guys run into this anytime they do an upgrade, etc. and have to go in and update the setting. Steve. On Tue, 2011-09-27 at 15:45 -0500, Brad Bendily wrote: >

Re: named-checkconf error

On 12/8/2008 11:00 AM, Chris Thompson wrote: In message <493b2b5d.40...@shockley.net>, Steve Shockley wrote: I'm running BIND 9.4.2 on OpenBSD 4.3. I'm getting some errors with named-checkconf I don't really understand. I'm running: named-checkzone -t /var/named cap

Re: DNS Appliance

[In a message on Wed, 25 Mar 2009 11:45:47 EDT, ""Eric C. Davis"" wrote:] >Infoblox user: Love them. Support is fantastic. I can name actual >support engineers. Is the fact that you can name support engineers a good thing or are you spending too much time t

Re: Windows servers triying to update my zone

On 4/7/2009 8:28 PM, joans4nz wrote: Apr 7 20:04:54 myserver named[67312]: client 172.16.0.146#2186: view interna: update 'mydomain.com/IN ' denied How fix this problem? Either don't use your Windows domain name externally, or ignore the messages. The update is deni

Re: can bind filter the result

On 4/20/2009 2:55 AM, Ken Lai wrote: normally, the client sent the query to SrvA, and SrvA forwards it to SrvB. and SrvA return a result which came from SrvB to the client. unfortunately the SrvB sometimes will return a A record that is a advertisement site ip to SrvA. so i dont want to respond

Re: Correction to signatures on yesterday's BIND 9 releases

. So.. what I suspect you get more of is "the signature is verified... but I have no idea who signed it!" CPAN's implementation of signature validation is probably an indication of the way things like this need to work, if the chain is going to be trusted from end to end. Steve _

Can't transfer RFC2317 reverse zone

I'm trying to setup a new server as a slave to our master DNS server. I am able to transfer several zones just fine, but when will not transfer. AT&T uses RFC2317-style zones for reverse delegation, so I've been delegated 0/27.146.68.12.in-addr.arpa. However, when I fired up BIND and tried to tra

Re: Can't transfer RFC2317 reverse zone

>> From what I have seen on this list, BIND typically spits out this >> error when it doesn't have write permission on its working directory. > >        No.  Read the error message.  It says "file not found" in >        this case the file not found was the directory "bak.0". > >> However, I know th

Re: Can't transfer RFC2317 reverse zone

>> Nope, no such file exists.  I've got bak.* for all my other zones, but >> not that one. > > The filename you use to *save* the zone file as is arbitrary, try > blah-blah How do I specify that? ___ bind-users mailing list bind-users@lists.isc.org

Re: Can't transfer RFC2317 reverse zone

> With the "file" statement in the zone declaration for that zone. > > Zone "0/27.146.68.12.in-addr.arpa" { >        ... >        file "blah-blah"; > # or    file "0.27.146.68.12.in-addr.arpa";  as I believe Mark Andrews > suggested >        ... > }; > > (See also Jeff Lightner's example earlier i

Bind 9.4.3-P3 on Solaris 10 Hang

sue. Has anyone else seen this type of behaviour? Cheers Steve ___ bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users

Re: Bind 9.4.3-P3 on Solaris 10 Hang

On Fri, 4 Dec 2009, Steve Foster wrote: Hi Folks, just to followup on this, I've caputred a core of named when this happens. From the looks of it there is a deadlock/very long pause occuring as most of the threads appear to be parked. The output of the stacktrace suggests that 3 out

Re: Using bind to provide a dns redirector

On 3/5/2010 12:23 PM, Alex Sharaz wrote: 1). We want users to have access to windows update and app update sites even from the unauth VLAN 2). Whatever else they try and get to via a browser, the host address gets resolved to a Hull IP address. The browser therefore connects to a local web serv

Re: Microsoft's nslookup Implementation Problems

On 6/13/2010 4:00 PM, Merton Campbell Crockett wrote: Inspecting the query log on the name server indicates that BIND never services a request from the system running Microsoft's nslookup tool. In addition, using tcpdump in controlled tests, I find that Microsoft's nslookup implementation never s

Re: FYI: FreeBSD: upgrade to protobuf-c 1.4.1_6 breaks dig

On Mon, Oct 14, 2024 at 07:19:06AM +0200, Peter wrote: > On Sun, Oct 13, 2024 at 10:55:52PM +0100, Niall O'Reilly wrote: > ! FYI only. I've submitted a [bug report][] to the FreeBSD Bugzilla. > > ! After upgrading to 1.4.1_6, I see: > ! > ! ``` > ! grab(maint)$ uname -a > ! FreeBSD grab.no8.be 1

Re: FYI: FreeBSD: upgrade to protobuf-c 1.4.1_6 breaks dig

On Mon, Oct 14, 2024 at 01:42:28PM +0200, Peter wrote: > On Mon, Oct 14, 2024 at 11:26:58AM +0100, Niall O'Reilly wrote: > ! On 14 Oct 2024, at 6:19, Peter wrote: > ! > ! > I cannot reproduce: > ! > ! Thanks. I've been made aware, off list, of people who can. > > Interesting. > I for my part do

Reverse lookups failing

wall issue? Is there anything else that might help narrow down the problem? Thanks for your assistance, Steve ___ bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users

RE: Slave Servers Return SERVFAIL

ewall issue? Is there anything else that might help narrow down the problem? Thanks for your assistance, Steve ___ bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users

RE: Reverse lookups failing

Please disregard. This is working now. Was either an ASA firewall dns filter which was stopped and restarted during testing or the setting of both nameservers to run bind9.3.5-P2. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Davenport, Steve M

RE: Reverse lookups failing

Davenport, Steve M Sent: Monday, November 17, 2008 8:20 PM To: [EMAIL PROTECTED] Subject: Reverse lookups failing Hello, I am having issues with reverse lookups failing and can not find the cause. Running bind 9.3.5-P1 and 9.3.6rc1. On an external server dig gives: $ dig @harley.mc.utmck.edu -x

RE: Workaround Solaris's kernel bug

Is the correct procedure to make this define: STD_CDEFINES='-DISC_SOCKET_USE_POLLWATCH' export STD_CDEFINES ./configure make -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Thomas Schulz Sent: Wednesday, November 19, 2008 4:25 PM To: bind-users@lists.i

bind image size

I have a server running Solaris10 and bind9.3.6 compiled with gcc3.3.2. The build was done with ./configure, make. The image size seems rather large at 10637668 bytes vs 4459328 bytes on a different Solaris10 system. Any ideas about the image size difference?

RE: bind image size

--- Davenport, Steve M [Mon, Dec 01, 2008 at 05:03:06PM -0500]: --- > I have a server running Solaris10 and bind9.3.6 compiled with gcc3.3.2. The build was done with ./configure, make. The image size seems rather large at 10637668 bytes vs 4459328 bytes on a different Solaris10 system. Any ideas about

can't see nameserver externally

165.6.131.32 Thanks for your help, Steve ___ bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users

delegating to 3rd Windows nameserver

h this configuration? Why is the sec2 server not seen in the query for nameservers? Thanks very much for your assistance. Steve ___ bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users

Not Exact error

Can someone tell me the cause of the "not exact" error and how to troubleshoot? 21-Mar-2011 11:01:24.931 xfer-in: error: transfer of '219.130.IN-ADDR.ARPA/IN' from 130.219.31.5#53: failed while receiving responses: not exact After this message appears, a retry on the transfer runs error free. Th

How to set a proxy using DHCP

I am new to the list and looking for a FAQ to determine how/if I can set up DHCP to put out a proxy to my workstations of workstation getting an IP address via DHCP. This is for dhcpd 8 installed on Centos 6.9 TIA. ___ Please visit https://lists.isc.org

Slow recursive query performance on Windows x64

ery-cache { none; }; recursion no; allow-query {any; }; zone "." in {type hint; file "named.cache"; }; zone "localhost" IN {type master; file "localhost.zone"; }; zone "0.

RE: Slow recursive query performance on Windows x64

400:9:3aa4:d340:93a1 2600:9000:2120:8000:9:3aa4:d340:93a1 2600:9000:2120:8600:9:3aa4:d340:93a1 2600:9000:2120:4c00:9:3aa4:d340:93a1 2600:9000:2120:be00:9:3aa4:d340:93a1 2600:9000:2120:e000:9:3aa4:d340:93a1 2600:9000:2120:fe00:9:3aa4:d340:93a1 -Steve Fr

RE: Slow recursive query performance on Windows x64

cess either, so those 's probably aren't helpful to them, but the log says this option is obsolete (and it does not actually filter out the responses with the option enabled). Does anyone know of a functionality that replaced the now-obsolete filter--on-v4? Thanks again,

RE: Slow recursive query performance on Windows x64

; }; and it still has the same delay problem, so it appears that even with -4 it's still trying to do something on v6 that it shouldn't be doing. So, server ::/0 { bogus yes; }; is still the fix... at least on Windows, anyway. Many thanks again to all of you for the insightful responses.

RE: Slow recursive query performance on Windows x64

go or no-go, perhaps it's not perceiving that General Failure means "don't keep trying this, it will never work" so it's still waiting for the timeout. I'm not saying you have to chase this down, just pointing out that this seems (to me) to be unexpected behavior

RE: Problem resolving domain

Hi, Stephan, If the domain has one working DNS server and one that's broken, but both are in the delegation, then it's somewhat of random luck as to which one you'll try first... If you try the bad one first, then what happens next depends on "how" it's bad. If it's just dead/down, then after a ti