Re: DNSSEC upgrade

2021-04-29 Thread Mark Elkins
Waiting twice the TTL is the safe option. Start counting from when you see the new DS record in the parent. To be even more pedantic, start counting after all authoritative Nameservers have the new DS record... Quite easy to do from a script. And the recommendation to move to ecdsa-p256-sha256

Re: DNSSEC upgrade

2021-04-29 Thread Edwardo Garcia
Halo Tony, Thank you, wow ecdsa-p256-sha256 produce keys 1/10th the size of rsa, strange how this better but we have made change as from your howto, thank you, now 24 hour and all seems ok from what we tell, and the test site says all good. One question however it talk about longest TTL, does

RE: Deprecating BIND 9.18+ on Windows (or making it community improved and supported)

2021-04-29 Thread Richard T.A. Neal
I would personally be very sad to see the end of BIND for Windows, but I don’t underestimate the challenges the ISC Team has in maintaining it. Unfortunately I'm a VB.NET hobbyist programmer rather than a C/C++ developer so I can't speak to the usefulness of the following statement, but the

Re: Deprecating BIND 9.18+ on Windows (or making it community improved and supported)

2021-04-29 Thread Ondřej Surý
> On 29. 4. 2021, at 15:42, Timothe Litt wrote: > > Would reducing support to just the diagnostic tools be a helpful middle > ground? Not really. The tools use the same internal libraries for networking. And it would bring more complexity and not less complexity. There’s no middle ground -

Re: Deprecating BIND 9.18+ on Windows (or making it community improved and supported)

2021-04-29 Thread @lbutlr
On 29 Apr 2021, at 05:35, Ondřej Surý wrote: > * Windows now has WSL2 > (https://docs.microsoft.com/en-us/windows/wsl/install-win10) that can be used > to run BIND 9 natively I'd suggest this be the first listed reason as it pretty much makes all the other reasons irrelevant. OTOH, I don't

Re: Deprecating BIND 9.18+ on Windows (or making it community improved and supported)

2021-04-29 Thread Timothe Litt
I gave up on running named on Windows long ago, so I generally support this direction. However, I do use the diagnostic tools (dig, delv, rndc, nsupdate) for troubleshooting.  It can be helpful to diagnose from the client environment (e.g. thru the same firewalls, anti-virus, buggy network stack,

Deprecating BIND 9.18+ on Windows (or making it community improved and supported)

2021-04-29 Thread Ondřej Surý
Hi, we’ve been discussing the /subj for quite some time and we are either thinking about deprecating the BIND 9 on Windows completely or just handing it over to the “community supported” level. There are couple reasons for the move: * Neither the VisualStudio 2017 which we use nor VS2019