Re: Is there any config to disable bind9 retry for rcode refused

2025-03-03 Thread Greg Choules via bind-users
Hi Neil. I don't think there is. Perhaps you should suggest it in a Gitlab issue? Just to be clear, though, please can you give an example of what you mean? A real life one would be best. Either a binary pcap or +vvv to screen of the query BIND makes and the REFUSED it receives followed by it retr

Is there any config to disable bind9 retry for rcode refused

2025-03-03 Thread Neil Nie (NSB)
Hi, I found that bind9 can retry for variant error rcode, which is very helpful. But there is one specific case for ANY response with rcode refused, retry from bind9 is not expected. Please advise if there is any config or method can achieve this. Thanks in advance! Neil Nie -- Visit https:/

Re: Where are ISC docs for log file codings?

2025-03-03 Thread Brett Delmage via bind-users
On Mon, 3 Mar 2025, Jan-Piet Mens wrote: You might want to begin your journey at [1], followed by [2]. [1] https://kb.isc.org/docs/aa-01031 [2] https://kb.isc.org/docs/aa-01526 Thanks. Thsi is in an area I did not search in earlier. Brett -- Visit https://lists.isc.org/mailman/listinfo/bind-u

Re: Where are ISC docs for log file codings?

2025-03-03 Thread Mark Andrews
It is documented in the Administrators Reference Manual (ARM). Look for the queries channel in the logging section. See Downloads on the ISC website for the ARM version appropriate for your release. e.g. https://downloads.isc.org/isc/bind9/9.20.6/doc/arm/html/reference.html#namedconf-statemen

Re: Where are ISC docs for log file codings?

2025-03-03 Thread Brett Delmage via bind-users
On Mon, 3 Mar 2025, Michael Richardson wrote: Brett Delmage via bind-users wrote: > Specifically for me now that's the query log including the flags. But it > could be other log files too at times. I am running DNSSEC and primary, > secondary, and internal resolving servers so many log

Re: Where are ISC docs for log file codings?

2025-03-03 Thread Jan-Piet Mens
Where is the documentation for how to interpret log file content? You might want to begin your journey at [1], followed by [2]. At least for querylogs you should find what you're looking for, many (most?) other logs will require a bit of experience to interpret. -JP [1] https://kb.i

Re: Where are ISC docs for log file codings?

2025-03-03 Thread Michael Richardson
Brett Delmage via bind-users wrote: > Specifically for me now that's the query log including the flags. But it > could be other log files too at times. I am running DNSSEC and primary, > secondary, and internal resolving servers so many logs are of interest at > different times. I

Where are ISC docs for log file codings?

2025-03-03 Thread Brett Delmage via bind-users
Where is the documentation for how to interpret log file content? Specifically for me now that's the query log including the flags. But it could be other log files too at times. I am running DNSSEC and primary, secondary, and internal resolving servers so many logs are of interest at different

Re: Questions about automatic KSK and using an additional stand-by KSK

2025-03-03 Thread Matthijs Mekking
Hi Bernd, Sorry for taking a long time to answer these questions: > 1) Timing Options: > > I didn't grasped yet all the defaults and their calculated interaction > when I let `bind9` manage the signing keys for a zone, which in the end > is just follows an RFC, if I'm right? I would like to "rep

Re: Questions about CVE-2024-11187

2025-03-03 Thread Petr Špaček
On 28. 02. 25 14:23, Laszlo Szollosi wrote: I'm hoping I can get some insight about the vulnerability mentioned above. We had been running BIND 9.20.4 in our infrastructure, and upgraded to 9.20.6 just recently. CVE-2024-12705 does not apply to our setup, yet we have a suspicion that we were im