Re: problems resolving domains unser NSxx.DOMAINCONTROL.COM - this problem i have too! :(((((

2010-06-22 Thread Rok Potočnik
On 22.6.2010 2:16, Mark Andrews wrote: I suspect that your firewall is dropping replies to EDNS queries that *don't* include the OPT record (i.e. they are plain DNS not EDNS responses). Note that there was no OPT record in the reply. I hardly think that my firewall configuration is faulty

Re: problems resolving domains unser NSxx.DOMAINCONTROL.COM - this problem i have too! :(((((

2010-06-22 Thread Erwin Lansing
On Mon, Jun 21, 2010 at 05:31:59PM +0200, Rok Poto??nik wrote: Anyway.. I found out what the problem is... they don't reply to dnssec enabled requests... $ dig +short @ns33.domaincontrol.com. replacementservices.com. 72.32.12.235 $ dig +short +dnssec @ns33.domaincontrol.com.

Re: our isp not supports EDNS?

2010-06-22 Thread Anatoly Pugachev
Mark, please see below... On 04.05.2010 / 14:31:25 +1000, Mark Andrews wrote: In message y2sf7e964441005031927m7774769ev280156817d8b4...@mail.gmail.com, Je ff Pang writes: Hello, Following the discussions in the list, I made a test on one of our servers, which is in an ISP's

Re: our isp not supports EDNS?

2010-06-22 Thread Anatoly Pugachev
Thanks Bill. I'm well aware of dns-oarc tests... but they are no more than firewall / dns packet size tests. My idea/concern is what could be wrong/broken (except of DNSSEC), if we disable eDNS on our servers - I need to carry this idea to my collegue. My quick test show that disabling edns per