Re: Strange issue with signed zone

2012-11-09 Thread Peter Andreev
2012/11/9 Peter Andreev : > 2012/11/9 Tony Finch : >> Peter Andreev wrote: >>> >>> We signed another zone and met the same problem again. The only >>> difference is algorithm - now it is RSASHA256. >>> >>> > We have ~30 servers running BIND (9.8, 9.7, 9.6). A week ago we >>> > signed first of our

Re: Strange issue with signed zone

2012-11-09 Thread Peter Andreev
2012/11/9 Tony Finch : > Peter Andreev wrote: >> >> We signed another zone and met the same problem again. The only >> difference is algorithm - now it is RSASHA256. >> >> > We have ~30 servers running BIND (9.8, 9.7, 9.6). A week ago we >> > signed first of our zones with RSA/SHA1 + NSEC3 + OPT-O

Re: Strange issue with signed zone

2012-11-09 Thread Tony Finch
Peter Andreev wrote: > > We signed another zone and met the same problem again. The only > difference is algorithm - now it is RSASHA256. > > > We have ~30 servers running BIND (9.8, 9.7, 9.6). A week ago we > > signed first of our zones with RSA/SHA1 + NSEC3 + OPT-OUT. > > Recently we realised th

Re: Strange issue with signed zone

2012-11-08 Thread Peter Andreev
Hi everybody! We signed another zone and met the same problem again. The only difference is algorithm - now it is RSASHA256. > We have ~30 servers running BIND (9.8, 9.7, 9.6). A week ago we > signed first of our zones with RSA/SHA1 + NSEC3 + OPT-OUT. > Recently we realised that our servers don't

Re: Strange issue with signed zone

2011-10-27 Thread Mark Elkins
On Wed, 2011-10-26 at 13:59 +0400, Peter Andreev wrote: > Hello! > > We have ~30 servers running BIND (9.8, 9.7, 9.6). A week ago we have > signed first of our zones with RSA/SHA1 + NSEC3 + OPT-OUT. > Recently we realised that our servers don't generate NSEC3 for signed zone. > Problem has gone af

Strange issue with signed zone

2011-10-26 Thread Peter Andreev
Hello! We have ~30 servers running BIND (9.8, 9.7, 9.6). A week ago we have signed first of our zones with RSA/SHA1 + NSEC3 + OPT-OUT. Recently we realised that our servers don't generate NSEC3 for signed zone. Problem has gone after we restarted BIND instances. Is described behaviour normal for