Re: Is it possible to move a zone between catalogs on the same secondary? It is.

> Wondering out loud: > Maybe it should skip loading that particular member zone if the "coo" > proproperty already points to different catalog? Would that be more > resilient against race conditions when named is restarted? That's an interesting suggestion, and I agree that it can solve the ra

Re: Is it possible to move a zone between catalogs on the same secondary? It is.

On 30. 04. 23 13:04, Aram Sargsyan wrote: Hello, Jan-Piet, > however, when I stop and restart the consumer server, I have sometimes (not always) seen > > catz: catz_addmodzone_cb: zone 'z10.aa' will not be added because another catalog zone already contains an entry with that zone > >whi

Re: Is it possible to move a zone between catalogs on the same secondary? It is.

Hello, Jan-Piet,   > however, when I stop and restart the consumer server, I have sometimes (not > always) seen >  > catz: catz_addmodzone_cb: zone 'z10.aa' will not be added because another > catalog zone already contains an entry with that zone > >which is true, but it doesn't _seem_ to ca

Re: Is it possible to move a zone between catalogs on the same secondary? It is.

And yes, you can automate this with nsupdate to old and new catalog, Brilliant, Petr, thank you. I saw some of the loviest log messages this week during coo from k-catz to t-catz: zone t-catz/IN: transferred serial 10: TSIG 't' catz: t-catz: reload start catz: updating

Re: Is it possible to upgrade bind from 9.11 to 9.18 directly?

Hi, a partial response: > If it's possible, can anyone confirm zone transfers from master > to slave would still work even if the servers ran different > major versions? Yes, "of course", because the details of that transfer is specified by the DNS protocol standards. Regards, - Håvard -- Vis

Re: Is it possible to upgrade bind from 9.11 to 9.18 directly?

Hi, thank you Ondřej and Stacy, we'll start testing next week. Kind regards, David Bruha Dne pátek 21. dubna 2023 10:03:26 CEST, Ondřej Surý napsal(a): > Hi, > > I can confirm that it’s ok to skip 9.16 and go straight to 9.18. There’s no > need for the intermediate step. As usual, it’s recommen

Re: Is it possible to upgrade bind from 9.11 to 9.18 directly?

Hi, I can confirm that it’s ok to skip 9.16 and go straight to 9.18. There’s no need for the intermediate step. As usual, it’s recommended to do a test migration first if you want to be extra careful. Ondrej -- Ondřej Surý — ISC (He/Him) My working hours and your working hours may be different

Re: Is it possible to upgrade bind from 9.11 to 9.18 directly?

If it helps, my assessment was that one could skip 9.16 too. I recognise that this is thanks to the hard effort that ISC work to provide backward compatibility, and not by some accident. On Solaris 11.4 current shipping versions of BIND are $ pkg list -fa service/network/dns/bind NAME (PUBLIS

Is it possible to upgrade bind from 9.11 to 9.18 directly?

Hi, we are currently running several bind 9.11 servers on Debian buster machines. We would like to upgrade and wonder if we could skip version 9.16 altogether or if it's a necessary middle step. We have read both https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-911-to-916[1]

Re: Is it possible to move a zone between catalogs on the same secondary?

On 19. 04. 23 19:23, Jan-Piet Mens wrote: Any ideas? is this the point at which I confess I've only now read about Change of Ownership (coo) [1]? Indeed. Chapter https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-dns-catalog-zones#name-change-of-ownership-coo-pro has an example how the pr

Re: Is it possible to move a zone between catalogs on the same secondary?

Any ideas? is this the point at which I confess I've only now read about Change of Ownership (coo) [1]? -JP [1] https://bind9.readthedocs.io/en/latest/chapter6.html#change-of-ownership-coo -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC fu

Is it possible to move a zone between catalogs on the same secondary?

I'm in the process of migrating a modest number of zones from one signer (OpenDNSSEC) to another (Knot-DNS). (The KSKs are identical so that should not be an issue for this question.) Each of the signers have a catalog (manually maintained for ODS, automatically for Knot) which is transferred

Is it possible to do In-line Signing for local root zone

I have local (private) root domain domainX.example and subdomains : subdomainY.domainX.example and subdomainZ.domainX.example. I can do chain of trust if all zones are In-line signed zone "domainX.example" { type master; file "named.domainX.example"; key-directory "/var/na

Re: Is it possible to use nsupdate with EDNS0?

On 2019-01-17 08:03, Fumiya Obatake wrote: Thank you for your reply. Since it seems very difficult to realize, I will consider other solutions. The obvious solution would be to use TCP. ___ Please visit https://lists.isc.org/mailman/listinfo/bind-user

Re: Is it possible to use nsupdate with EDNS0?

Thank you for your reply. Since it seems very difficult to realize, I will consider other solutions. Sincerely, ___ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.is

Re: Is it possible to use nsupdate with EDNS0?

plans to do so. s/named/nsupdate/ > -- > Mark Andrews > >> On 17 Jan 2019, at 00:14, Fumiya Obatake wrote: >> >> Is it possible to use nsupdate with edns0? >> >> Hello, all. >> I have some questions about nsupdate. >> >> I try to update a set of

Re: Is it possible to use nsupdate with EDNS0?

TCP still needs to be supported on the server anyway there really is no point in trying. Named does not attempt to send larger than 512 byte updates via UDP. There are no plans to do so. -- Mark Andrews > On 17 Jan 2019, at 00:14, Fumiya Obatake wrote: > > Is it possible to use

Is it possible to use nsupdate with EDNS0?

Is it possible to use nsupdate with edns0? Hello, all. I have some questions about nsupdate. I try to update a set of TXT records over 512 bytes in all by using nsupdate without -v option, and it makes TCP connection automatically. In RFC2136, `An update transaction may be carried in a UDP

Re: [BIND] Re: Is it possible to...

-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Fri, 2018-08-10 at 09:47 +1000, Mark Andrews wrote: > > On 10 Aug 2018, at 5:46 am, Jim Popovitch via bind-users > s...@lists.isc.org> wrote: > > > > -BEGIN PGP SIGNED MESSAGE- > > Hash: SHA512 > >

Re: Is it possible to...

> On 10 Aug 2018, at 5:46 am, Jim Popovitch via bind-users > wrote: > > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA512 > > Is it possible to... > > 1) use text only zone files, and > > 2) keep serials identical between those zone files and what is &g

Is it possible to...

-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Is it possible to... 1) use text only zone files, and 2) keep serials identical between those zone files and what is published in DNS, and 3) automatically handle signatures when adding new RRs, and 4) not have any journal files. Is all of

Re: Is it possible to filter (*.)wpad.* with RPZ?

On 11/30/2017 12:04 AM, Daniel Stirnimann wrote: I doubt you can use RPZ for that. The testing that I did made me think that RPZ wouldn't be able to do it. I wonder if Response Policy Service (DNSRPS) can do it. We use https://dnsdist.org/ for that, our rule: -- WPAD Name Collission Vulnera

Re: Is it possible to filter (*.)wpad.* with RPZ?

7 19:12, Grant Taylor via bind-users wrote: > Is it possible to filter (*.)wpad.* with RPZ? Or do I need to look into > Response Policy Service and try to filter that way? > > I've used RPZ for various different things over the years, but I don't > quite know how to match

Is it possible to filter (*.)wpad.* with RPZ?

Is it possible to filter (*.)wpad.* with RPZ? Or do I need to look into Response Policy Service and try to filter that way? I've used RPZ for various different things over the years, but I don't quite know how to match a wild card on the right hand side. Context: I'd

Re: Is it possible to have separate query logs for different views?

ED MESSAGE- > > Hash: SHA512 > > > > On 3/9/15 3:04 AM, Peter Olsson wrote: > > > Hello! > > > > > > Is it possible to have separate query logs for different views? > > > > > > I tried putting this in the view block, but it failed with &q

Re: Is it possible to have separate query logs for different views?

--BEGIN PGP SIGNED MESSAGE- > Hash: SHA512 > > On 3/9/15 3:04 AM, Peter Olsson wrote: > > Hello! > > > > Is it possible to have separate query logs for different views? > > > > I tried putting this in the view block, but it failed with "unknown > > opt

Re: Is it possible to have separate query logs for different views?

-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On 3/9/15 3:04 AM, Peter Olsson wrote: > Hello! > > Is it possible to have separate query logs for different views? > > I tried putting this in the view block, but it failed with "unknown > option 'logging'"

Is it possible to have separate query logs for different views?

Hello! Is it possible to have separate query logs for different views? I tried putting this in the view block, but it failed with "unknown option 'logging'": logging { channel logging_query { file "/var/log/named/query-ins

Re: [RI-DISCUSS] Is it possible to block or modify DNS' resolution of a malware address?

Came up with this as a simple straight-forward quick answer http://www.malwaredomains.com/bhdns.html My thanks to everyone who responded so quickly! Our phishing email looked like this You have exceeded the storage capacity of your designated mail box and is thus required to revalidate immediat

RE: Is it possible to block resolution of a malware address?

ginal Message- From: bind-users-bounces+jbaird=follett@lists.isc.org [mailto:bind-users-bounces+jbaird=follett@lists.isc.org] On Behalf Of Stewart Dean Sent: Friday, April 01, 2011 10:22 AM To: bind-users@lists.isc.org Subject: Is it possible to block resolution of a malware address? Th

Re: Is it possible to block resolution of a malware address?

> That is, if we know that a symbolic address is malign, is there some way > to > refuse to resolve it or change its resolution when an internal users asks > for > its resolution? Two different ways of doing this: - configure your BIND to believe it's authoritative for the address(es) in question

Is it possible to block resolution of a malware address?

That is, if we know that a symbolic address is malign, is there some way to refuse to resolve it or change its resolution when an internal users asks for its resolution? All my Google searching turns up DNSBLs and blocking incoming mail from BLed addresses, but this is another matter... Than

Re: Is it Possible to Log nxdomain Responses?

On 17/11/2010 15:23, Stephane Bortzmeyer wrote: > On Wed, Nov 17, 2010 at 07:48:55AM -0600, > Martin McCormick wrote > a message of 22 lines which said: > >> It would be nice to log each nxdomain for a while so we can verify >> that the new deligated zone we are about to install fixed the >>

Re: Is it Possible to Log nxdomain Responses?

On Wed, Nov 17, 2010 at 07:48:55AM -0600, Martin McCormick wrote a message of 22 lines which said: > It would be nice to log each nxdomain for a while so we can verify > that the new deligated zone we are about to install fixed the > problem. May be with dnscap

Re: Is it Possible to Log nxdomain Responses?

On 17/11/10 13:48, Martin McCormick wrote: We are chasing down some problems in which clients are trying to resolve lookups to a domain related to Microsoft Active Directory zones. We were able to determine that clients were querying this AD zone when it was thought they weren't needing to do so.

Is it Possible to Log nxdomain Responses?

We are chasing down some problems in which clients are trying to resolve lookups to a domain related to Microsoft Active Directory zones. We were able to determine that clients were querying this AD zone when it was thought they weren't needing to do so. We enabled querylogging for a short

RE: is it possible to dynamically update an RRSIG record?

>Jack Tavares wrote: >> Looking at the code for libbind, specifically >> res_nmkupdate, >> there is no case statement for RRSIG records. >> >> In this case, I was trying to update the TTL. >> Is that not allowed intentionally? > >I think so. The TTL of a RRSIG RR *MUST* match the TTL value of th

Re: is it possible to dynamically update an RRSIG record?

Jack Tavares wrote: > Looking at the code for libbind, specifically > res_nmkupdate, > there is no case statement for RRSIG records. > > In this case, I was trying to update the TTL. > Is that not allowed intentionally? I think so. The TTL of a RRSIG RR *MUST* match the TTL value of the RRset i

is it possible to dynamically update an RRSIG record?

Looking at the code for libbind, specifically res_nmkupdate, there is no case statement for RRSIG records. In this case, I was trying to update the TTL. Is that not allowed intentionally? Thank you -- Jack Tavares "How many more can we sell with this button?"

Re: [OT] Is it possible to set a ddns hostname to access a name-based virtual host?

In article , Michael Milligan wrote: > Danny Mayer wrote: > > Michael Milligan wrote: > >> Just being more general. A URL is a HTTP URI... Google has plenty of > >> explanations. > > > > That's nonsense. A URL was never just an HTTP URI. It's one example of > > one but there have always been m

Re: [OT] Is it possible to set a ddns hostname to access a name-based virtual host?

Danny Mayer wrote: > Michael Milligan wrote: >> Just being more general. A URL is a HTTP URI... Google has plenty of >> explanations. > > That's nonsense. A URL was never just an HTTP URI. It's one example of > one but there have always been more than one type. I wasn't clear. A URL covers a su

Re: [OT] Is it possible to set a ddns hostname to access a name-based virtual host?

Michael Milligan wrote: > hongyi.z...@gmail.com wrote: >>> You *must* reference the location using the same URI if you expect to >>> see the same expected results. >> Thanks for your detailed explanations. Another issue: what do you >> mean by saying URI? What's the differences between URI an

Re: [OT] Is it possible to set a ddns hostname to access a name-based virtual host?

hongyi.z...@gmail.com wrote: > >> You *must* reference the location using the same URI if you expect to >> see the same expected results. > > Thanks for your detailed explanations. Another issue: what do you > mean by saying URI? What's the differences between URI and URL? Just being more

Re: Is it possible to set a ddns hostname to access a name-based virtual host?

In article , hongyi.z...@gmail.com wrote: > On Friday, February 20, 2009 at 22:15, serge.fonvi...@gmail.com wrote: > > Let me give an example to illustrate my problem: > > > In the following url, the prola.aps.org is a name-based virtual host: > > > http://prola.aps.org/pdf/PRB/v1/i1/p1_1 > >

Re: Is it possible to set a ddns hostname to access a name-based virtual host?

gt; Suppose a file named file.pdf stored in the following web location: > > http://some_domain/path/to/file.pdf > > Where, the *some_domain* is a name-based virtual host. In this case, > is it possible to set a ddns hostname, say through > http://www.changeip.net/, without using *s

Is it possible to set a ddns hostname to access a name-based virtual host?

Hi all, Suppose a file named file.pdf stored in the following web location: http://some_domain/path/to/file.pdf Where, the *some_domain* is a name-based virtual host. In this case, is it possible to set a ddns hostname, say through http://www.changeip.net/, without using *some_domain

Re[2]: Is it possible to set a ddns hostname to access a name-based virtual host?

name-based virtual host. In this case, >> is it possible to set a ddns hostname, say through >> http://www.changeip.net/, without using *some_domain* itself, to >> access this file? >> >> > DNS can only control what IP address the client connects to. It doesn

Re[2]: [OT] Is it possible to set a ddns hostname to access a name-based virtual host?

On Saturday, February 21, 2009 at 0:31, mi...@acmeps.com wrote: > This is actually off topic for BIND-users... > hongyi.z...@gmail.com wrote: >> On Friday, February 20, 2009 at 19:51, serge.fonvi...@gmail.com wrote: >>> Hi, >> >>> Is it possible to set a

Re: Is it possible to set a ddns hostname to access a name-based virtual host?

Hongyi Zhao wrote: Hi all, Suppose a file named file.pdf stored in the following web location: http://some_domain/path/to/file.pdf Where, the *some_domain* is a name-based virtual host. In this case, is it possible to set a ddns hostname, say through http://www.changeip.net/, without

Re: [OT] Is it possible to set a ddns hostname to access a name-based virtual host?

This is actually off topic for BIND-users... hongyi.z...@gmail.com wrote: > On Friday, February 20, 2009 at 19:51, serge.fonvi...@gmail.com wrote: >> Hi, > >> Is it possible to set a ddns hostname, say through >> http://www.changeip.net/ , without using *some_domain* it

Re[4]: Is it possible to set a ddns hostname to access a name-based virtual host?

On Friday, February 20, 2009 at 22:15, serge.fonvi...@gmail.com wrote: > Let me give an example to illustrate my problem: > In the following url, the prola.aps.org is a name-based virtual host: > http://prola.aps.org/pdf/PRB/v1/i1/p1_1 > On the other hand, my institute has subscribed to prola

Re: Re[2]: Is it possible to set a ddns hostname to access a name-based virtual host?

> > Let me give an example to illustrate my problem: > > In the following url, the prola.aps.org is a name-based virtual host: > > http://prola.aps.org/pdf/PRB/v1/i1/p1_1 > > On the other hand, my institute has subscribed to prola and many other > journals, so I want to use some self-made and eas

Re: Is it possible to set a ddns hostname to access a name-based virtual host?

In article , hongyi.z...@gmail.com wrote: > On Friday, February 20, 2009 at 19:51, serge.fonvi...@gmail.com wrote: > > Hi, > > > Is it possible to set a ddns hostname, say through > > http://www.changeip.net/ , without using *some_domain* itself, to > > access t

Re[2]: Is it possible to set a ddns hostname to access a name-based virtual host?

On Friday, February 20, 2009 at 19:51, serge.fonvi...@gmail.com wrote: > Hi, > Is it possible to set a ddns hostname, say through > http://www.changeip.net/ , without using *some_domain* itself, to > access this file? > Not entirely sure what you are actually trying to achie

Re: Is it possible to set a ddns hostname to access a name-based virtual host?

Hi, > Is it possible to set a ddns hostname, say through > http://www.changeip.net/ , without using *some_domain* itself, to > access this file? > <http://www.changeip.net/> Not entirely sure what you are actually trying to achieve. Could you provide a concrete example of the

Is it possible to set a ddns hostname to access a name-based virtual host?

Hi all, Suppose a file named file.pdf stored in the following web location: http://some_domain/path/to/file.pdf Where, the *some_domain* is a name-based virtual host. In this case, is it possible to set a ddns hostname, say through http://www.changeip.net/, without using *some_domain

Re: Is it possible to use one KSK for multiple domains?

In message <[EMAIL PROTECTED]>, Chris Tho mpson writes: > On Nov 20 2008, Stephane Bortzmeyer wrote: > > >On Thu, Nov 20, 2008 at 11:55:17AM +, > > Chris Thompson <[EMAIL PROTECTED]> wrote > > a message of 33 lines which said: > > > >>> The text you quote is for DNS publication. But you typi

Re: Is it possible to use one KSK for multiple domains?

On Nov 20 2008, Stephane Bortzmeyer wrote: On Thu, Nov 20, 2008 at 11:55:17AM +, Chris Thompson <[EMAIL PROTECTED]> wrote a message of 33 lines which said: The text you quote is for DNS publication. But you typically do not put KSK in the DNS, no? Sure you do. How could a validator use

Re: Is it possible to use one KSK for multiple domains?

On Thu, 2008-11-20 at 14:15 +0100, Adam Tkac wrote: > It isn't possible to validate myzone1.tld. with key from other zone, > for example myzone2.tld., is it? No, but Chris explained better than I did what I had in mind. On Thu, 2008-11-20 at 11:43 +, Chris Thompson wrote: > the DNSKEY

Re: Is it possible to use one KSK for multiple domains?

On Thu, Nov 20, 2008 at 11:55:17AM +, Chris Thompson <[EMAIL PROTECTED]> wrote a message of 33 lines which said: >> The text you quote is for DNS publication. But you typically do not >> put KSK in the DNS, no? > > Sure you do. How could a validator use it if you didn't? Because it is pub

Re: Is it possible to use one KSK for multiple domains?

On Thu, Nov 20, 2008 at 09:18:01AM +, Niall O'Reilly wrote: > On Wed, 2008-11-19 at 21:55 +0100, Adam Tkac wrote: > > does anyone know if is it possible to sign multiple domains with one > > KSK? > > Adam, > > I suspect your question may need to

Re: Is it possible to use one KSK for multiple domains?

On Nov 20 2008, Stephane Bortzmeyer wrote: [...snipped...] [Warning: still struggling with the subtleties of KSK/ZSK.] The text you quote is for DNS publication. But you typically do not put KSK in the DNS, no? Sure you do. How could a validator use it if you didn't? Perhaps you meant: you wo

Re: Is it possible to use one KSK for multiple domains?

On Nov 19 2008, Adam Tkac wrote: does anyone know if is it possible to sign multiple domains with one KSK? If I understand correctly what RFC 4034, section 2.1.1 says "... If bit 7 has value 1, then the DNSKEY record holds a DNS zone key, and the DNSKEY RR's owner name MUST be the

Re: Is it possible to use one KSK for multiple domains?

On Wed, 2008-11-19 at 21:55 +0100, Adam Tkac wrote: > does anyone know if is it possible to sign multiple domains with one > KSK? Adam, I suspect your question may need to be more specific. Are you asking about the signing process itself, or rather abo

Re: Is it possible to use one KSK for multiple domains?

On Wed, Nov 19, 2008 at 09:55:52PM +0100, Adam Tkac <[EMAIL PROTECTED]> wrote a message of 17 lines which said: > If I understand correctly what RFC 4034, section 2.1.1 says "... If > bit 7 has value 1, then the DNSKEY record holds a DNS zone key, and > the DNSKEY RR's owner name MUST be the na

Is it possible to use one KSK for multiple domains?

Hi all, does anyone know if is it possible to sign multiple domains with one KSK? If I understand correctly what RFC 4034, section 2.1.1 says "... If bit 7 has value 1, then the DNSKEY record holds a DNS zone key, and the DNSKEY RR's owner name MUST be the name of a zone..." i