how to modify NTASKS and NRECVS in lwresd?

2014-04-24 Thread Sam Roza
Hello, I have a customer who is trying to eke out additional performance in lwresd but increasing the number/ration of NTASKS:NRECVS in lwresd. Is there an option to modify this in stock bind 9.8.x or 9.9.x? Thanks. - Sam Roza, RHCE Technical Account Manager Global Support Services Red Ha

Strange validation failure for answers.ssh.com

2014-04-24 Thread Tony Finch
We have a couple of recursive servers running 9.9.5 which are persistently unable to validate answers.ssh.com, returning SERVFAIL. With debug logging turned on we get (amongst lots of other things): 24-Apr-2014 16:41:23.087 client 131.111.56.28#35569 (answers.ssh.com): query (cache) 'answers.ssh.

Re: DNSSEC domain and sub-domains

2014-04-24 Thread rod
On Apr 24, 2014, at 11:01 AM, Tony Finch wrote: > r...@iastate.edu wrote: > >> If we implement DNSSEC for iastate.edu, admin.iastate.edu and >> its.iastate.edu, must DNSSEC be implemented for the delegated zones as >> well? > > No, in exactly the same way that signing .edu does not mean iasta

Re: DNSSEC domain and sub-domains

2014-04-24 Thread Tony Finch
r...@iastate.edu wrote: > If we implement DNSSEC for iastate.edu, admin.iastate.edu and > its.iastate.edu, must DNSSEC be implemented for the delegated zones as > well? No, in exactly the same way that signing .edu does not mean iastate.edu has to be signed. If there are no DS records at the del

DNSSEC domain and sub-domains

2014-04-24 Thread rod
We are getting ready to implement DNSSEC on our campus. Our main domain is iastate.edu. I have zone records for department and units, such as admin.iastate.edu, its.iastate.edu, cs.iastate.edu and ee.iastate.edu. Two of the zones are delegated (cs.iastate.edu and ee.iastate.edu). If we implement

Re: All client resolvers support DNSSEC compatible queries ???

2014-04-24 Thread Peter Andreev
2014-04-24 13:46 GMT+04:00 Carsten Strotmann : > Hello Jeronimo, > > "Jeronimo L. Cabral" writes: > >> Dear, we have several hosts in our LAN that ask our BIND DNS: Debian, >> Windows 7, Red Hat and CentOS. >> >> If we implement DNSSEV validation support in our BIND9 server...how >> can I know if

Re: All client resolvers support DNSSEC compatible queries ???

2014-04-24 Thread Tony Finch
Carsten Strotmann wrote: > > You can enable DNSSEC validation support on a BIND 9 caching server that > is used as a resolver by your clients. BIND 9 9.9.x already comes with > DNSSEC validation enabled, for older versions you need to enable it > manually in the configuration. DNSSEC validation n

Re: All client resolvers support DNSSEC compatible queries ???

2014-04-24 Thread Carsten Strotmann
Hello Jeronimo, "Jeronimo L. Cabral" writes: > Dear, we have several hosts in our LAN that ask our BIND DNS: Debian, > Windows 7, Red Hat and CentOS. > > If we implement DNSSEV validation support in our BIND9 server...how > can I know if our hosts' resolvers are compatible with DNSSEC queries >

Re: What means -EDC in bind9 logs ?

2014-04-24 Thread Carsten Strotmann
Jean-François Leroux writes: > Hi, > must be a stupid question but I hadn't noticed before that some > queries in my server are labelled like that > > query IN A -ED (or EDC, or EC) > > What does this mean ? you'll find the documentation for query-log entries in the BIND Administra