Bind unable to get MX reocrd from Parrent name server

2013-07-05 Thread Fosiul Alam
Hi Occasionally we see customer is complainning that we are not able to resolve mx record when mxtoolbox or other website can resolve their mx record . If i do a trace on the domain, i get bellow . now the problem is : demeter.is.co.za. and babylon.mitsol.co.za does not know anything about MX

Re: Bind unable to get MX reocrd from Parrent name server

2013-07-05 Thread Steven Carr
Your glue is broken. You need to update the glue NS records in the parent to reflect the actual nameservers that are authoritative for the zone. It also looks like you could have some data mismatch between zones hosted on (ns1.yithosting.co.za + ns2.yithosting.co.za) and (demeter.is.co.za +

Re: Bind unable to get MX reocrd from Parrent name server

2013-07-05 Thread Fosiul Alam
Hi thanks for reply, I am not the domain admin for rbcaa.co.za I can see they have issue with their domain setup . but what I want to know is : when all Dns server can resolved their mx record example , mxtoolbox,introdns,google .. (Despite they have issue with their dns setup for that domain (as

Re: Bind unable to get MX reocrd from Parrent name server

2013-07-05 Thread Matus UHLAR - fantomas
On 05.07.13 12:59, Fosiul Alam wrote: I am not the domain admin for rbcaa.co.za I can see they have issue with their domain setup . but what I want to know is : when all Dns server can resolved their mx record example , mxtoolbox,introdns,google .. (Despite they have issue with their dns setup

Re: Bind unable to get MX reocrd from Parrent name server

2013-07-05 Thread John Wobus
The other DNS server software is working around or ignoring the issues. Server software varies in how much it ignores or works around bad domain setups. Also, in some situations, configuration problems result in symptoms that come and go. One reason DNS software is picky about correct setups

Re: How to suppress ADDITIONAL SECTION per zone

2013-07-05 Thread John Wobus
Other possibility is to implement packet rate limiting - a patch was discussed here a few days/weeks ago. I endorse this suggestion: we were faced with such attacks and were naturally leery about issues we might run into running a patched bind and the additional tuning it could require. Our

Re: How to suppress ADDITIONAL SECTION per zone

2013-07-05 Thread Vernon Schryver
From: John Wobus jw...@cornell.edu Other possibility is to implement packet rate limiting - a patch was discussed here a few days/weeks ago. I endorse this suggestion: we were faced with such attacks and were naturally leery about issues we might run into running a patched bind and the

Re: Reverse address entries

2013-07-05 Thread John Wobus
On Jun 28, 2013, at 3:54 PM, Ward, Mike S wrote: I want to thank everyone for their input. It sounds like they do need the reverse address entries in specific circumstances so I’m going to recommend that they add them. Lack of reverse records made a big difference in the distant past. Now,

RRL and avoiding contributing to DDoS (Was: How to suppress ADDITIONAL SECTION per zone)

2013-07-05 Thread Dave Warren
On 2013-07-05 07:21, John Wobus wrote: I endorse this suggestion: we were faced with such attacks and were naturally leery about issues we might run into running a patched bind and the additional tuning it could require. Our experience is: the RRL patch, used with its default parameters, simply

Re: RRL and avoiding contributing to DDoS (Was: How to suppress ADDITIONAL SECTION per zone)

2013-07-05 Thread Vernon Schryver
From: Dave Warren da...@hireahit.com I haven't been following the RRL discussions too closely, is this patch scheduled to be included in BIND9 proper or will it remain a patch? } From: Evan Hunt each at isc.org } It's not built into bind (yet). } } Correct. For the record, it'll be in