Re: BIND9 DNSSEC algorithm rollover for inline-signed zone

2016-10-07 Thread Mark Andrews
In message <20161007164742.ga18...@danton.fire-world.de>, Sebastian Wiesinger writes: > * Mark Andrews [2016-10-06 23:33]: > > > is there a guide for an algorithm rollover with BIND9 for an > > > inline-signed zone? I want to roll from RSA to ECDSA but I'm unable to > > > find a good guide for i

RE: ThreatSTOP BIND DNS Firewall Available

2016-10-07 Thread Joe Dahlquist
Hi John, Thanks for the feedback! I'm Joe, Product Mgr here at ThreatSTOP. You are correct in that the quick start guide is not BIND specific, nor is it really device specific at all and touches more on helping a new user understand elements of our service such as building a custom policy, creati

Re: BIND9 DNSSEC algorithm rollover for inline-signed zone

2016-10-07 Thread Sebastian Wiesinger
* Mark Andrews [2016-10-06 23:33]: > > is there a guide for an algorithm rollover with BIND9 for an > > inline-signed zone? I want to roll from RSA to ECDSA but I'm unable to > > find a good guide for it. I already looked at the ISC DNSSEC Guide but > > it doesn't seem to cover that the RRSIGs mad

RE: Unspecified error DNS query

2016-10-07 Thread Darcy Kevin (FCA)
There's nothing particularly unusual about the "retrying in TCP mode" message - as Mark explained, that happens whenever the packet size is big and EDNS0 is not being used. I looked up this name from an internal Windows 7 box through a BIND-based forwarder (in North America), and it resolves fi

Re: Unspecified error DNS query

2016-10-07 Thread Mark Andrews
In message <"02ec01d22092$81eaabc0$85c00340$@dawalibi"@idm.net.lb>, Daniel Dawa libi writes: > > Hello > > We are getting "Unspecified error" when querying our DNS server (Query: > outlook.live.com) from a PC communication with our DNS > > We tried to perform the same query from the DNS itsel

Unspecified error DNS query

2016-10-07 Thread Daniel Dawalibi
Hello We are getting "Unspecified error" when querying our DNS server (Query: outlook.live.com) from a PC communication with our DNS We tried to perform the same query from the DNS itself (local host) and we found that the Dig output is showing with the following message "Truncated, retry

Re: [Question] zone transfer not happening

2016-10-07 Thread Tony Finch
Eoin Kim wrote: > > So, all zone data files were created and when I restarted BIND the zone > transfer happens except for one zone - reverse zone for external view. I > checked the log file and it shows the following message. > > general: info: zone 10.16.172.IN-ADDR.ARPA/IN/EXTERNAL: refresh: une

Re: need clarification on "forward" behavior

2016-10-07 Thread Tony Finch
Veaceslav Revutchi wrote: > I see the server forwarding the query and it gets the answer below: > > ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 > ;; > ;; ANSWER SECTION: > aaa.example.org. 200 IN CNAME bbb.example.net. > bbb.example.net. 60 IN A 10.64.64.64 > > I would

Re: bind caching data from additional section in responses

2016-10-07 Thread Tony Finch
ben thielsen via bind-users wrote: > > zone "example.com" { > type stub; > masters { > "example.com" ; > }; > }; > > masters "example.com" { > 192.168.81.50 ; > }; If you want a fixed set of master servers for a zone, use static-stub. A stub zone works a bit