Re: 0-TTL when querying "invalid" soa

2019-01-29 Thread Tom
Perfect.., many thanks for your hints. Tom On 29.01.19 16:33, Tony Finch wrote: Tom wrote: We're running BIND-9.12.3-P1 on our authoritative servers and we have the same behavior with 0-ttl with a invalid soa-query. Is this bind-specific? Why does an invalid soa-record responds with 0-ttl i

Re: Bind9 forward/reverse zones with multiple TSIG keys

2019-01-29 Thread Grant Taylor via bind-users
On 01/29/2019 02:41 PM, Rick Dicaire wrote:  Regardless how the change is stored, journal or zone file? It's my understanding that dynamic update implies a journal file for the zone. Meaning they are inseparably linked. You can tell BIND to freeze & flush the changes from the journal to th

Re: Bind9 forward/reverse zones with multiple TSIG keys

2019-01-29 Thread Rick Dicaire
On Tue, Jan 29, 2019 at 1:02 PM Grant Taylor via bind-users < bind-users@lists.isc.org> wrote: > Are you referring to the catalog zone itself allowing dynamic updates? > Or allowing dynamic updates to the zones that are listed in the catalog > zone(s)? > Either... I don't see any reason why

Re: Bind9 forward/reverse zones with multiple TSIG keys

2019-01-29 Thread Grant Taylor via bind-users
On 01/29/2019 09:43 AM, Rick Dicaire wrote: Wonder if you can use ddns zones with catalog zones, haven't tried it myself... Are you referring to the catalog zone itself allowing dynamic updates? Or allowing dynamic updates to the zones that are listed in the catalog zone(s)? Thinking about

Re: Selective forwarding?

2019-01-29 Thread Bob Harold
On Tue, Jan 29, 2019 at 10:56 AM @lbutlr wrote: > > > > On 29 Jan 2019, at 00:25, ObNox wrote: > > > > On 24/01/2019 10:26, Sam Wilson wrote: > > > Note: I'm assuming a zone expiry of a week to a month. I think that > would accommodate most outages. > >>> > >>> I thought of that too :-) A

Re: Bind9 forward/reverse zones with multiple TSIG keys

2019-01-29 Thread Rick Dicaire
Wonder if you can use ddns zones with catalog zones, haven't tried it myself... On Tue, Jan 29, 2019 at 11:27 AM Grant Taylor via bind-users < bind-users@lists.isc.org> wrote: > On 01/29/2019 01:19 AM, ObNox wrote: > > Hi, > > Hi ObNox, > > > For that to work, I need to make sure every separated

Re: Bind9 forward/reverse zones with multiple TSIG keys

2019-01-29 Thread Grant Taylor via bind-users
On 01/29/2019 01:19 AM, ObNox wrote: Hi, Hi ObNox, For that to work, I need to make sure every separated component works as expected when configured separately. Ah, yes. The joys / perils of testing discrete units individually and then start pugging them together like Legos and making sur

Re: Selective forwarding?

2019-01-29 Thread @lbutlr
> On 29 Jan 2019, at 00:25, ObNox wrote: > > On 24/01/2019 10:26, Sam Wilson wrote: > Note: I'm assuming a zone expiry of a week to a month. I think that would accommodate most outages. >>> >>> I thought of that too :-) A week would be far enough in my case. >> Be careful of what

Re: 0-TTL when querying "invalid" soa

2019-01-29 Thread Mukund Sivaraman
On Tue, Jan 29, 2019 at 04:23:56PM +0100, Tom wrote: > We're running BIND-9.12.3-P1 on our authoritative servers and we have the > same behavior with 0-ttl with a invalid soa-query. Is this bind-specific? > Why does an invalid soa-record responds with 0-ttl in the authority-section? It appears to

Re: 0-TTL when querying "invalid" soa

2019-01-29 Thread Tony Finch
Tom wrote: > > We're running BIND-9.12.3-P1 on our authoritative servers and we have the same > behavior with 0-ttl with a invalid soa-query. Is this bind-specific? Why does > an invalid soa-record responds with 0-ttl in the authority-section? Funnily enough, this little obscurity came up elsewhe

0-TTL when querying "invalid" soa

2019-01-29 Thread Tom
Hi list The following "invalid" soa-query responds with NXDOMAIN and with a ttl of 0 for the SOA-Record in the authoritative section: $ dig +norec +noquestion @ns1.yahoo.com. soa asfasdfdas.yahoo.com ; <<>> DiG 9.11.3-1ubuntu1.3-Ubuntu <<>> +norec +noquestion @ns1.yahoo.com. soa asfasdfdas.ya

Re: DNSEC and Bin 9.12

2019-01-29 Thread @lbutlr
On 21 Jan 2019, at 12:32, @lbutlr wrote: > A couple of questions I’d like to thank everyone who helped out on this, got it all sorted, added to the registrar, and it is all working, Now to do it for all the other domains. :) -- The most perfidious way of harming a cause consists of defending

Bind9 forward/reverse zones with multiple TSIG keys

2019-01-29 Thread ObNox
Hi, Following a previous thread (ie: "Selective forwarding?"), I've started to work on a multi-server configuration within 3 sites consisting of a primary at Site1 and secondaries at Site2/3. All sites will have DHCP servers with DDNS enabled. The secondaries will forward the DDNS updates to