Re: Reason for Limited number of Root DNS Servers

2011-11-14 Thread Florian Weimer
* Gaurav Kansal: As root DNS are running in anycast so number is not an issue at all. But I don't understand where exactly is this limitation exists??? The limitation does not exist, otherwise it would not have been possible to add IPv6 addresses to the priming response. -- Florian Weimer

DNS Amplification Attack and different results in bind 9.6/9.7

2011-11-14 Thread Euiho Kim
Hi, I wrote email 1 days ago (subject name: DDoS attack and difference actions in bind 9.6 / 9.7) But I wonder mail could not approach to your mailbox, so I request support again. First, Recently “isc.org ANY” DDoS Attack is frequently generated in our DNS System (recursive Cache DNS) Query

Help with dig to check NS servers for DNSSEC setup

2011-11-14 Thread Eduardo Bonsi
I am checking my DNS setup from inside using dig and I am getting everything ok but I need a second opinion from outside of the server to see if my ns1 and ns2 are responding ok to setup DNSSEC. Thanks! user:~ user1$ dig bonsi.org ; DiG 9.6-ESV-R4-P3 bonsi.org ;; global options: +cmd ;;

RE: Help with dig to check NS servers for DNSSEC setup

2011-11-14 Thread Adamiec, Lawrence
Here are some results using the same commands you used. # dig bonsi.org ; DiG 9.6.1-P3 bonsi.org ;; global options: +cmd ;; Got answer: ;; -HEADER- opcode: QUERY, status: SERVFAIL, id: 1462 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;bonsi.org.

RE: Help with dig to check NS servers for DNSSEC setup

2011-11-14 Thread lst_hoe02
Zitat von Adamiec, Lawrence ladam...@kentlaw.edu: Here are some results using the same commands you used. # dig @63.200.45.18 ns1.bonsi.org soa ; DiG 9.6.1-P3 @63.200.45.18 ns1.bonsi.org soa ; (1 server found) ;; global options: +cmd ;; Got answer: ;; -HEADER- opcode: QUERY, status:

Re: DNS Amplification Attack and different results in bind 9.6/9.7

2011-11-14 Thread Stephane Bortzmeyer
On Tue, Nov 15, 2011 at 03:51:52AM +0900, Euiho Kim leokim...@gmail.com wrote a message of 215 lines which said: In bind-9.6 installed server, response query rcvd msg size is 600~700 byte, But bind-9.7, response rcvd msg size is 3100~3400 byte(large size), It includes lots of DNSSEC

Re: Help with dig to check NS servers for DNSSEC setup

2011-11-14 Thread Stephane Bortzmeyer
On Mon, Nov 14, 2011 at 12:38:44PM -0800, Eduardo Bonsi beart...@pacbell.net wrote a message of 123 lines which said: if my ns1 and ns2 are responding ok to setup DNSSEC. ... user:~ user1$ dig bonsi.org dig, by default, does not request DNSSEC data. If you want to test with DNSSEC, add

Re: Help with dig to check NS servers for DNSSEC setup

2011-11-14 Thread Eduardo Bonsi
Since my servers are getting status refused from outside, could someone shine me a light what is wrong here? Here is a copy of my named conf file for the master. Thanks! // // Include keys file key rndc-key { algorithm hmac-md5; secret yyxx-not-the-real-key-xmc/xxx/z/x==;

Re: Help with dig to check NS servers for DNSSEC setup

2011-11-14 Thread Barry Margolin
In article mailman.95.1321308136.68562.bind-us...@lists.isc.org, Eduardo Bonsi beart...@pacbell.net wrote: Since my servers are getting status refused from outside, could someone shine me a light what is wrong here? Here is a copy of my named conf file for the master. You have the same

Re: Help with dig to check NS servers for DNSSEC setup

2011-11-14 Thread Eduardo Bonsi
Barry; Thanks, I fixed that! I am also not sure if that will help with the server fail or status refused issue when checked from outside. Eduardo On 11/14/11 6:58 PM, Barry Margolin wrote: In articlemailman.95.1321308136.68562.bind-us...@lists.isc.org, Eduardo Bonsibeart...@pacbell.net

Syncing DNS zones with different names

2011-11-14 Thread Chris Balmain
Let's say I have two domain names, d1.com and d2.com, and I want to synchronise all records underneath them (one-way sync, that is). So if I create an A record www.d1.com pointing at 1.2.3.4, www.d2.com is also automatically created, with the same value. So it's almost like a master/slave

Re: Syncing DNS zones with different names

2011-11-14 Thread Barry Margolin
In article mailman.98.1321341621.68562.bind-us...@lists.isc.org, Chris Balmain bind-us...@wtf.net.au wrote: Let's say I have two domain names, d1.com and d2.com, and I want to synchronise all records underneath them (one-way sync, that is). So if I create an A record www.d1.com pointing at