Re: Cannot resolve outside my TLD - all others give SERVFAIL

2010-04-28 Thread Matus UHLAR - fantomas
On 28.04.10 16:55, Chris C wrote: > This instance is used as a caching resolver with blacklists. The > blacklists are fed what is basically a null.zone file. how do you implement blacklists? show me example of one blacklisted zone configuration - not the zone file but the part of named.conf. > I

Re: Query - No Response

2010-04-28 Thread ic.nssip
Hi Mark, What is the reason for rejecting non-autoritative answers? I have other servers that are resolving this query even the answer is non-autoritative. Non-authoritative answer: Name:www.cancer.ca Address: 65.110.160.32 Thank you, Julian In message <7097328fe40440f2bf8419d9b6967.

Re: dnssec-keygen & dnssec-signzone "smart signing" vs time zones

2010-04-28 Thread Paul B. Henson
On Wed, 28 Apr 2010, Mark Andrews wrote: > Would something like this be better? Do you need a UTC after the > timestamp. [...] > ; Created: 20100429025050 (Thu Apr 29 12:50:50 2010) Even though it's just a comment, it would be nice for it not to be ambiguous. As a comment, the raw value isn't ver

Re: dnssec-keygen & dnssec-signzone "smart signing" vs time zones

2010-04-28 Thread Mark Andrews
In message , " Paul B. Henson" writes: > On Wed, 28 Apr 2010, Mark Andrews wrote: > > > The .private timestamps are in UTC and that is what is used for key > > management. The .key values are just comments. You should be able to > > work out my current offset from UTC. > > > > % grep Created Kl

Re: dnssec-keygen & dnssec-signzone "smart signing" vs time zones

2010-04-28 Thread Paul B. Henson
On Wed, 28 Apr 2010, Mark Andrews wrote: > The .private timestamps are in UTC and that is what is used for key > management. The .key values are just comments. You should be able to > work out my current offset from UTC. > > % grep Created Kl.+005+59421.* > Kl.+005+59421.key:; Created: T

Re: dnssec-keygen & dnssec-signzone "smart signing" vs time zones

2010-04-28 Thread Mark Andrews
In message , " Paul B. Henson" writes: > > I've been testing dnssec-keygen and the "smart signing" mode of > dnssec-signzone and have run into some timezone confusion; I'm not sure if > it's expected behavior or a bug. I searched around a bit and didn't find > anything relevant, apologies in adva

dnssec-keygen & dnssec-signzone "smart signing" vs time zones

2010-04-28 Thread Paul B. Henson
I've been testing dnssec-keygen and the "smart signing" mode of dnssec-signzone and have run into some timezone confusion; I'm not sure if it's expected behavior or a bug. I searched around a bit and didn't find anything relevant, apologies in advance if I missed a FAQ. If I create a new key leav

Re: Query - No Response

2010-04-28 Thread Mark Andrews
In message <7097328fe40440f2bf8419d9b6967...@internal.corp.ds>, "ic.nssip" writ es: > Hello everyone, > > I have a strange issue on a DNS server that is not able to resolve = > www.cancer.ca [65.110.160.32]. > If somebody has an idea about what is going wrong there, I will really = > appreciate a

Query - No Response

2010-04-28 Thread ic.nssip
Hello everyone, I have a strange issue on a DNS server that is not able to resolve www.cancer.ca [65.110.160.32]. If somebody has an idea about what is going wrong there, I will really appreciate any suggestions on how to make it work. Here is my dig and dig +trace test on that server: U:\>dig

Cannot resolve outside my TLD - all others give SERVFAIL

2010-04-28 Thread Chris C
Hello, Has anyone ran into something like this? I am running the following version of Bind: BIND 9.6.2-P1-RedHat-9.6.2-3.P1 built with '--host=x86_64-redhat-linux-gnu' '--build=x86_64-redhat-linux-gnu' '--target=x86_64-redhat-linux' '--program-prefix=' '--prefix=/usr' '--exec-prefix=/usr' '--bin

Re: Switching to TCP in BIND.

2010-04-28 Thread Kevin Darcy
On 4/28/2010 6:22 AM, kalpesh varyani wrote: Hi all, Please let me know if there is some feature in any of the versions of BIND, by which it switches to TCP when it detects spoofed replies. I am aware that BIND uses UDP for all its query / response and TCP for zone transfers. I know

Re: bind multi-threaded question

2010-04-28 Thread Marco Davids (SIDN)
max power wrote: > i am running bind on chroot jail, every thing is working fine > i only got one bind process ? > multi-threaded is enabled when compile , but should i find 8 processes > how can i be sure that bind is using 8 threads Running Linux? You may want to try adding a 'proc'-directory i

RE: bind multi-threaded question

2010-04-28 Thread Lightner, Jeff
On most *nixes ps only shows the process and not the thread though they may have tools to see thread information. Linux will show you the threads as if they were processes. >From CentOS5 (linux) man page: To get info about threads: ps -eLf ps axms ___

Re: bind multi-threaded question

2010-04-28 Thread Fr34k
Hello, http://en.wikipedia.org/wiki/Process_%28computing%29 may help to explain what is going on. HTH From: max power To: bind-users@lists.isc.org Sent: Wed, April 28, 2010 4:38:06 AM Subject: bind multi-threaded question Hi i am deploying a new dns ser

Switching to TCP in BIND.

2010-04-28 Thread kalpesh varyani
Hi all, Please let me know if there is some feature in any of the versions of BIND, by which it switches to TCP when it detects spoofed replies. I am aware that BIND uses UDP for all its query / response and TCP for zone transfers. Regards, Kalpesh __

Re: bind multi-threaded question

2010-04-28 Thread Jeff Pang
On Wed, Apr 28, 2010 at 4:38 PM, max power wrote: > Hi > i am deploying a new dns server using bind 9.7.0-p1 the latest version > i am running bind on chroot jail, every thing is working fine > when i use the command rndc status i got the following , > CPUs found: 8 > worker threads: 8 > this is r

bind multi-threaded question

2010-04-28 Thread max power
Hi i am deploying a new dns server using bind 9.7.0-p1 the latest version i am running bind on chroot jail, every thing is working fine when i use the command rndc status i got the following , CPUs found: 8 worker threads: 8 this is right info , however when i try to ps aux | grep named i only go