Re: Minimum TTL?

2018-02-13 Thread Reindl Harald
Am 10.02.2018 um 05:11 schrieb John Levine: But to answer your question, off-hand, I'd say that any TTL under 60s is = suspicious and any TTL under 10s is almost certainly intentionally = abusive. I hope you're not planning to do much spam filtering i do for years with a min-ttl of 90 secod

Re: Minimum TTL?

2018-02-13 Thread Reindl Harald
Am 12.02.2018 um 20:36 schrieb wbr...@e1b.org: From: "Reindl Harald" To: bind-users@lists.isc.org the ISP has no business to touch any package bewteen source and me because he can't know the implications - he even must not know about them because it#s not his business And yet they do (Su

BIND 9.11.2 acting as a forwarder: authority section populated differently than BIND 9.9.11 ?

2018-02-13 Thread Irwin Tillman
I'm preparing to upgrade from BIND 9.9.11 to 9.11.2. I notice a difference in how named populates the authority section in some responses, and am trying to understand if it's OK. My server is a caching-only server, and provides recursive service. For some zones, my server is configured to forwa

Re: BIND 9.11.2 acting as a forwarder: authority section populated differently than BIND 9.9.11 ?

2018-02-13 Thread Tony Finch
Irwin Tillman wrote: > > When my server is running BIND 9.9.11, it returns an answer with the > authority section populated. > > But when I upgrade my server to BIND 9.11.2, the same lookup > performed immediately after I start my server returns no authority records, > which is a surprise to me:

DNSSEC validation

2018-02-13 Thread SIMON BABY
Hello, I am trying to implement the full recursive resolver with libbind library in my client code. I am not using resolv.conf in my implementation. Can anyone please help to point any sample code for this. Thank you for your help and time. Rgds simon ___

Re: DNSSEC validation

2018-02-13 Thread Evan Hunt
On Tue, Feb 13, 2018 at 12:08:18PM -0800, SIMON BABY wrote: > I am trying to implement the full recursive resolver with libbind library > in my client code. I am not using resolv.conf in my implementation. Can > anyone please help to point any sample code for this. Not even BIND uses libbind anymo

Re: DNSSEC validation

2018-02-13 Thread SIMON BABY
Hello Evan, Thank you so much for the quick response. My requirement is to implement only the recursive resolve and validation part of the DNSSEC in my client application. Our CPU and memory are very limited. So I am not sure I can go and use BIND 9. With BIND 9, can I integrate the library in m

Re: DNSSEC validation

2018-02-13 Thread Evan Hunt
On Tue, Feb 13, 2018 at 12:42:26PM -0800, SIMON BABY wrote: > My requirement is to implement only the recursive resolve and validation > part of the DNSSEC in my client application. Our CPU and memory are very > limited. So I am not sure I can go and use BIND 9. But why do you need your applicatio

Re: DNSSEC validation

2018-02-13 Thread SIMON BABY
Hello Evan, Thanks you so much for answering my questions. Inline my comments. But why do you need your application to contain a recursive resolver? 1. Assume if I use an external recursive resolver and if that resolver does not support DNSSEC, how can I validate the signature? 2. If I use an e

Re: DNSSEC validation

2018-02-13 Thread Warren Kumari
On Tue, Feb 13, 2018 at 3:42 PM, SIMON BABY wrote: > Hello Evan, > > Thank you so much for the quick response. > > My requirement is to implement only the recursive resolve and validation > part of the DNSSEC in my client application. Our CPU and memory are very > limited. So I am not sure I can g

Re: DNSSEC validation

2018-02-13 Thread SIMON BABY
Thanks Warren. I will look into https://getdnsapi.net/ . Rgds simon On Tue, Feb 13, 2018 at 2:07 PM, Warren Kumari wrote: > On Tue, Feb 13, 2018 at 3:42 PM, SIMON BABY wrote: > > Hello Evan, > > > > Thank you so much for the quick response. > > > > My requirement is to implement only the rec

Re: DNSSEC validation

2018-02-13 Thread Evan Hunt
On Tue, Feb 13, 2018 at 01:33:10PM -0800, SIMON BABY wrote: > 1. Assume if I use an external recursive resolver and if that resolver does > not support DNSSEC, how can I validate the signature? Depends what you mean by supporting DNSSEC; see below. > 2. If I use an external resolver and if a hack

Re: DNSSEC validation

2018-02-13 Thread SIMON BABY
Thanks Evan for answering my questions. I will look more into getdns-api or libunbund library for the client side resolve. Rgds Simon On Tue, Feb 13, 2018 at 3:00 PM, Evan Hunt wrote: > On Tue, Feb 13, 2018 at 01:33:10PM -0800, SIMON BABY wrote: > > 1. Assume if I use an external recursive reso

Testing

2018-02-13 Thread Dan Mahoney
Please ignore -- just testing post mailman upgrade. Best, -Dan Mahoney ISC Operations Group ___ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org https://lists