Re: DJB and root ns server dnssec signing

2010-04-19 Thread John R. Levine
ok this is the bit that worries me That looks perfectly normal, since .museum is a TLD and doesn't have an A record. Try about.museum, which has these records in the TLD's zone file: about.museum.86400 IN NS nic.frd.se. about.museum.86400 IN NS n

Re: DJB and root ns server dnssec signing

2010-04-19 Thread krad
On 19 April 2010 16:06, John R. Levine wrote: > I think watch i really need to do is find a root ns that is already serving >> signed records then limit djb to that, and then i can do some testing. My >> gut feeling is that it will be ok, but its no where near 90% let alone >> 100% >> which is wh

Re: DJB and root ns server dnssec signing

2010-04-19 Thread John Levine
I also use djbdns and don't expect any particular problems, since you don't get EDNS responses if you don't make EDNS queries. There's a one-line patch I can probably dig up which makes dnscache accept oversized responses. Dunno if it would help, but it's unlikely to hurt. R's, John

Re: DJB and root ns server dnssec signing

2010-04-19 Thread John R. Levine
I think watch i really need to do is find a root ns that is already serving signed records then limit djb to that, and then i can do some testing. My gut feeling is that it will be ok, but its no where near 90% let alone 100% which is why im nervous. PR nightmare if it does go wrong The roots al

Re: DJB and root ns server dnssec signing

2010-04-19 Thread krad
On 19 April 2010 15:56, John Levine wrote: > I also use djbdns and don't expect any particular problems, since you > don't get EDNS responses if you don't make EDNS queries. > > There's a one-line patch I can probably dig up which makes dnscache > accept oversized responses. Dunno if it would he

Re: DJB and root ns server dnssec signing

2010-04-19 Thread krad
On 19 April 2010 13:06, Vincent Hoffman wrote: > On 19/04/2010 12:12, krad wrote: > > Hi, > > > > Not strictly a freebsd question this but I'm feeling jittery about this > as I > > cant afford it to go wrong. > > > > As you are probably aware the root zones are going to be signed soon. I > run >

Re: DJB and root ns server dnssec signing

2010-04-19 Thread Vincent Hoffman
On 19/04/2010 12:12, krad wrote: > Hi, > > Not strictly a freebsd question this but I'm feeling jittery about this as I > cant afford it to go wrong. > > As you are probably aware the root zones are going to be signed soon. I run > a number of heavily used dns caches (~ 600-900 queries / sec) runn

DJB and root ns server dnssec signing

2010-04-19 Thread krad
Hi, Not strictly a freebsd question this but I'm feeling jittery about this as I cant afford it to go wrong. As you are probably aware the root zones are going to be signed soon. I run a number of heavily used dns caches (~ 600-900 queries / sec) running djb dnscache. From what I can see dnscach