Re: Dig 9.7 DNSSEC output

2010-05-09 Thread R Dicaire
On Sun, May 9, 2010 at 11:24 AM, Peter Janssen peter.jans...@eurid.euwrote: ;; ADDITIONAL SECTION: ns.nic.se. 3600IN A 212.247.7.228 ns.nic.se. 3600IN 2a00:801:f0:53::53 ns2.nic.se. 3600IN A 194.17.45.54

Re: Dig 9.7 DNSSEC output

2010-05-09 Thread R Dicaire
On Sun, May 9, 2010 at 11:48 AM, Peter Janssen peter.jans...@eurid.euwrote: as per the header of Dig output… ;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 9 Curious, I too get 9 but only 8 RRs are shown: ; DiG 9.7.0-P1 +dnssec @rdb.ardynet.com ardynet.com ns ; (2

Re: problem with bind stop

2009-07-01 Thread R Dicaire
2009/7/1 Joan Marc Riera marc.ri...@barcelonamedia.org: we have some troubles with restart and stop. bind does not stop and I think it's because of a wrong kill argument on the stop) case. This isn't a bind problem per se, have you talked to the debian maintainer, or filed a bug report with

control channel logging

2009-06-21 Thread R Dicaire
Hi folks, bind 9.6.1...I'm looking in the ARM but I dont see a logging category specific to control channel communications. In syslog I have (generated by an mrtg script): named[7837]: received control channel command 'stats' What category does this fall under? Thanks -- aRDy Music and Rick

bind 9.6.1 stats dump

2009-06-18 Thread R Dicaire
Hi folks, while looking at a stats dump from bind 9.6.1 I see: ++ Per Zone Query Statistics ++ but there are no stats showing for this, how is this enabled (if at all)? Thanks -- aRDy Music and Rick Dicaire present: http://www.ardynet.com http://www.ardynet.com:9000/ardymusic.ogg.m3u

nsec and nsec3 records

2009-06-13 Thread R Dicaire
Hi folks, Can both nsec and nsec3 records be used simultaneously in a zone file, or is it an either/or? Thanks -- aRDy Music and Rick Dicaire present: http://www.ardynet.com http://www.ardynet.com:9000/ardymusic.ogg.m3u ___ bind-users mailing list

Re: nsec and nsec3 records

2009-06-13 Thread R Dicaire
On Sat, Jun 13, 2009 at 10:03 PM, Evan Hunte...@isc.org wrote: Why would you want them both?  If you don't mind the drawbacks of NSEC, why take on the operational and computational burdens of NSEC3? I don't know why, I'm simply not knowledgeable enough in DNSSEC deployment. Currently I'm using

Re: [DNSSEC] SERVFAIL when resolving .gov through DLV

2009-05-05 Thread R Dicaire
On Tue, May 5, 2009 at 2:34 PM, Stephane Bortzmeyer bortzme...@nic.fr wrote: I get a SERVFAIL when trying to resolve .gov: I get: ; DiG 9.4.3-P2 +dnssec SOA gov. ;; global options: printcmd ;; Got answer: ;; -HEADER- opcode: QUERY, status: NOERROR, id: 32204 ;; flags: qr rd ra; QUERY: 1,

Re: Postgres v MySQL v Berkely backend for BIND

2009-05-04 Thread R Dicaire
On Mon, May 4, 2009 at 3:16 PM, Stephen Carville stephen.carvi...@gmail.com wrote: Anyone here have experience or an informed opinion in using a database backend to BIND? I've been using the pgsql sdb backend for 5+ years, wrote my own php front end to it. Its been solid. -- aRDy Music and

ISC DLV dnssec

2009-04-05 Thread R Dicaire
Hi folks, last night the ISC server responsible for responding to DLV lookups was apparently down. Since all lookups were failing due to a lack of response from this server, bind couldn't resolve anything at all. I had to comment out a couple lines in named.conf to restore function. bind-9.4.3-P2

Re: ISC DLV dnssec

2009-04-05 Thread R Dicaire
On Sun, Apr 5, 2009 at 5:40 PM, Mark Andrews mark_andr...@isc.org wrote: Shouldn't the behaviour for DLV lookups be such that if the query can't be answered by the DLV server, then fall back to a non-dnssec lookup?        No. May I ask why? I'm sure something was learned from whatever caused

Re: ISC DLV dnssec

2009-04-05 Thread R Dicaire
On Sun, Apr 5, 2009 at 7:02 PM, Evan Hunt evan_h...@isc.org wrote: vigilant; this particular failure won't occur again.  And we were already in the process of making dlv.isc.org substantially more robust, so hopefully any similar breakages that might have come along in the future will be

Re: ISC DLV dnssec

2009-04-05 Thread R Dicaire
On Sun, Apr 5, 2009 at 8:48 PM, Mark Andrews mark_andr...@isc.org wrote:        Named is still able to return answers if you tell it not to        validate the answers by setting CD=1 in the query.  This flag        is usually used when you have a validating resolver using another        

Re: name server zone list

2009-04-03 Thread R Dicaire
On Fri, Apr 3, 2009 at 10:55 AM, Chris Thompson c...@cam.ac.uk wrote: This one is hardy perennial, of course, but I've been working on an index zone in a certain local DNS context recently, and thinking how convenient it would have been if BIND had provided one for me (under class CHAOS, name

Re: name server zone list

2009-04-03 Thread R Dicaire
On Fri, Apr 3, 2009 at 2:08 PM, Alan Clegg alan_cl...@isc.org wrote: The entire list of zones is available in XML format in the statistics channel in 9.5 Yep, you need to parse for it, but it's there... Hah beautiful, why reinvent the wheel :) I've not yet moved to 9.5 simply because I

Re: SERVFAIL debugging

2009-03-13 Thread R Dicaire
On Fri, Mar 13, 2009 at 4:59 PM, JINMEI Tatuya / 神明達哉 jinmei_tat...@isc.org wrote: Please try 9.6.1b1, which we expect to be released next week. It has a new experimental feature just for that purpose: Is this feature going to be back ported to 9.4 and 9.5 releases as well? -- aRDy Music

Re: Two outgoing queries for each incoming query

2009-03-12 Thread R Dicaire
On Thu, Mar 12, 2009 at 7:43 AM, My Name mylistuser1...@gmail.com wrote: I want to setup a forwarder and each incoming query (in fact only A or ) should be sent to two different upstream servers. Why? ___ bind-users mailing list

Re: automatic resigning in 9.6.x

2009-03-07 Thread R Dicaire
On Fri, Mar 6, 2009 at 11:46 PM, Evan Hunt evan_h...@isc.org wrote: BIND 9 has, I believe, always had some support for automatic signing in the case of zone updates--at least as far back as 9.3, and I haven't looked at anything earlier.  Basically, if you have a signed zone and you insert a

dnssec and sdb/dlz

2009-03-07 Thread R Dicaire
I haven't found any documentation on this, but is it possible to implement dnssec/signed zones if the zone data exists in an sql db instead of a zone file? I know I can modify an sql table for a zone to have additional fields (for sdb use) for the additional RR types, but will the sdb interface

Re: connection timed out; no servers could be reached

2009-03-07 Thread R Dicaire
On Sat, Mar 7, 2009 at 8:44 PM, Bill Landry b...@inetmsg.com wrote: I have to admit that I am a bit baffled by this one.  I can query against my bandwidth providers name servers (Comcast) and get name resolution just fine for the hostname www.malware.com.br: Check firewall settings. Connection

arbitrary key names in named.conf

2009-03-07 Thread R Dicaire
I've been using the key file name as key name in named.conf for simplicity, but I find that distros tend to use a default filename for a host key, so can I just use the key contents and assign it an arbitrary name in named.conf? -- aRDy Music and Rick Dicaire present: http://www.ardynet.com