Re: OpenDNS today announced it has adopted DNSCurve to secure DNS

2010-02-24 Thread bsfinkel
Joe Baptista wrote: >Someone else has written the RFC draft - which see http://bit.ly/b5mFkV That draft has this text, "Expires: February 27, 2010" [3 days from today]. I am not sure what an expiration date means officially on a draft RFC.

`named' uses 32-bit capabilities

2010-02-23 Thread bsfinkel
In production I am running BIND 9.6.1-P3 on Solaris 9, sun4u sparc SUNW,Sun-Fire-V240. When I start BIND I get this message: Jan 25 11:03:17 dns1 named[9673]: [ID 873579 daemon.notice] built with '--prefix=/export/home/named/bind' '--with-openssl=/krb5' '--sysconfdir=/

Re: Question about "rndc flushname"

2010-02-09 Thread bsfinkel
bsfin...@anl.gov wrote: >> On a mail machine I am running a cache-only DNS - BIND 9.6.1-P3. >> When I dump the cache I see two lines: >> >> ; answer >> brainpower-austria.at. 6622MX 5 mx1.bon.at. >> >> I then enter >> >> ./rndc flushname brainpower-austria.at >> >> But

Question about "rndc flushname"

2010-02-04 Thread bsfinkel
On a mail machine I am running a cache-only DNS - BIND 9.6.1-P3. When I dump the cache I see two lines: ; answer brainpower-austria.at. 6622MX 5 mx1.bon.at. I then enter ./rndc flushname brainpower-austria.at But when I then look at the cache, I still see the MX record

Re: Bind slave to Windows 2008 AD/DNS

2009-12-08 Thread bsfinkel
Jukka Pakkanen wrote: >Thanks. Those 6 zones are subdomains to company.local so I guess they >are covered. What about the _msdcs.company.local, is that needed in >slaves? If the zone company.local is mastered on a MX Windows DNS Server, then that zone will contain the records that would

FORMERR

2009-12-04 Thread bsfinkel
Occasionally I will look the "lame-log" on one of my BIND 9.6.1-P1 servers and find FORMERR messages. Then I do DNS queries to try to understand why the FORMERR occurred. Here is one where I am confused: 03-Dec-2009 16:07:50.722 lame-servers: info: FORMERR resolving 'd2rdfnizen5apl.stl2.cloud

Re: BIND Secondaries of MS AD Integrated Zones

2009-11-18 Thread bsfinkel
jim.siffe...@tektronix.com wrote: >Most of our internal DNS zones are mastered in Microsoft DNS (2k3 R2) >as AD Integrated zones. Currently, those zones are slaved from a >single MS DNS server to our BIND 9 servers that handle recursion. Is >there a reliable way to use multiple masters when slav

Re: Slave to Win2003 DNS

2009-11-02 Thread bsfinkel
Jukka Pakkanen wrote: >Our Bind 9.6.1-P1 Windows servers are slaves to a Windows 2003 DNS >server, zone "company.local". > >For some reason t he slaves don't update the zone unless I restart the >BIND service in the server, and after a while, fail to respond to queries. > >Example, after a coup

Re: CNAME for MX Record?

2009-08-19 Thread bsfinkel
Bradley Caricofe wrote: >> Hey list, >> >> I have the following issue. A customer hosts a domain with me, >> facplus.com. Her primary email account is on that domain, we'll call >> it her at facplus.com. She has also registered another name through >> Dotster, meetingtoolsandjewels.com. Dotster pro

FW: Delegating reverse DNS to a customer

2009-08-18 Thread bsfinkel
On Tue, Aug 18, 2009 at 8:31 AM, Tim Huffman wrote: > Guys, > > > > We're a smallish (but growing) ISP, and we've been asked by one of our > customers to delegate reverse DNS for 63.250.251.0/24 to their DNS servers, > ns1.emns.com - ns4.emns.com. Unfortunately, we've never had to delegate DNS > to

Re: BIND 9.5.1-P3 compilation problems.

2009-08-11 Thread bsfinkel
Emery wrote: >I've conducted two maintenance windows to upgrade our BIND primary >server to the new code to address the recent security vulnerability, but >cannot get past the error below. I have Openssl 9.8.0k installed. I have >no problems running tests from the openssl prompt. I have tried

Re: Moving an AD Zone from Windows to BIND

2009-07-28 Thread bsfinkel
bsfin...@anl.gov wrote: >> This is not really a BIND-related question, but I thought that maybe >> some people on this list can point me in the right direction. >> Maybe someone has already done what I need to do. >> >> I have one zone >> >> xxx.yyy.example.com >> >> that is on a Windows DN

Re: bind 9 problem with delegation

2009-07-28 Thread bsfinkel
gui wrote: >hello, > >i have s strange probleme with my bind server, and i hope someone >could point out the problem, here is the description, > >i have two bind servers (replication, multi-master), bind 9.3.4, same >version, same configuration (normally). >I tried to do some PTR delegation, so f

Moving an AD Zone from Windows to BIND

2009-07-23 Thread bsfinkel
This is not really a BIND-related question, but I thought that maybe some people on this list can point me in the right direction. Maybe someone has already done what I need to do. I have one zone xxx.yyy.example.com that is on a Windows DNS server, completely under the control of Windows.

Re: Trouble With One Domain

2009-06-26 Thread bsfinkel
Stephane Bortzmeyer wrote, in part: >The problem (NS going to CNAME) was properly identified by Hauke Lampe >very soon in the thread. Read it. > >> "Unable to find primary nameserver (SOA)" > >Well, the error message could be better, that's sure... There are a number of reasons why the SOA could

Re: Trouble With One Domain

2009-06-26 Thread bsfinkel
Frank Bulk wrote: >> If you change the nameservers for IllinoisAcceleratorInstitute.org at its >> registrar to point to t1dns1.anl.gov and t1dns2.anl.gov you should be good >> to go. and Andy Shellam replied: >And not forgetting to change the master server in the SOA record from >oxygen, as that

Re: Trouble With One Domain

2009-06-26 Thread bsfinkel
bsfin...@anl.gov wrote: >> There are problems accessing this domain from the Internet, and I cannot >> determine what the problem is. I have no trouble from Argonne, as the >> domain is slaved on all of my servers. I do not see any problem with >> the delegations, but I may be missing something.

Trouble With One Domain

2009-06-25 Thread bsfinkel
We own the domain IllinoisAcceleratorInstitute.org There are problems accessing this domain from the Internet, and I cannot determine what the problem is. I have no trouble from Argonne, as the domain is slaved on all of my servers. I do not see any problem with the delegations, but I may

avoid-v4-udp-ports

2009-06-22 Thread bsfinkel
I am running 9.6.0-P1, and I added to my BIND options statement: avoid-v4-udp-ports { range 20030 20777;}; When I did an "rndc config" I saw this message: using default UDP/IPv4 port range: [1024, 65535] in /var/adm/messages. Is BIND doing what I wanted (e.g., use UDP ports 1024-2002

Minor "query (cache) denied" Logging Bug?

2009-04-01 Thread bsfinkel
I have a name server that is authoritative for the zone tlh.fl.us. In that zone is a record freenet.tlh.fl.us. IN CNAME tfn.net. My server is not authoritative for tfn.net. Some external client sends a request: What is the MX for freenet.tlh.fl.us.? My server responds (thi

Re: rndc reconfig issue

2009-02-24 Thread bsfinkel
"Ronni Jensen" wrote: >Hi, > >Every night I have a perl script generate a config file which contains >approximately 5000 zones at the moment, but this will vary in size as >zones are added/removed. > >However, when I put >>include "/etc/special-zones.conf";<< into >named.conf and do "rndc reconfi

Re: bind 9.60p1 on solaris 10

2009-02-23 Thread bsfinkel
In Mark Andrews writes: In message <937393c4-77a8-4dba-8a4f-14560c25c...@o11g2000yql.googlegroups.com>, >> SN writes: >>> >>> libcrypto.so.0.9.8 is not being found as a link library. Trying to >>> run as in a chroot'ed environment on solaris 10 (core install). >>> Kindly advise. >> Insta

Re: query an external nameserver doubt

2009-02-19 Thread bsfinkel
On 19.02.09 12:26, Nuno Ribeiro wrote: >> There is a CNAME Record "www.example.test.com CNAME ts.example.test2.com" >> in the "example.test.com" zone, which my nameserver is not authoritive. My >> name server is authoritive for "example.test2.com" zone. >> >> I receive a A query for "www.example.

Re: How many nameservers?

2009-02-02 Thread bsfinkel
On Sun, Feb 1, 2009 at 7:51 PM, shulkae wrote: >> How may NS entries typically is allowed per zone? Is there a bind >> limit or does it cause any side effects if the >> slaves are geographically distributed ? >> >> We would like to setup one zone for my new group who have offices all >> over the

e: BIND 9.6 Flaw - CNAME vs. A Record in MX Records are NOT "Illegal"

2009-01-27 Thread bsfinkel
Al Stu" wrote: >How about these two? > >> nullmx.domainmanager.com >Non-authoritative answer: >Name:mta.dewile.net >Address: 69.59.189.80 >Aliases: nullmx.domainmanager.com > >> smtp.secureserver.net >Non-authoritative answer: >Name:smtp.where.secureserver.net >Address: 208.109.80.149

Re: BIND 9.6 Flaw - CNAME vs. A Record in MX Records are NOT "Illegal"

2009-01-26 Thread bsfinkel
I have not copied the entire thread. >You've added an additional step in your second paragraph that is >prohibited by the section you quoted in the first. The section from >the RFC describes a situation where A is queried for and an MX record >pointing to B is returned. When B is queried f

Re: delegating to 3rd Windows nameserver

2009-01-14 Thread bsfinkel
Davenport, Steve M" wrote, in part, Hello, >We have nameservers supporting utmck.edu and delegate the zones used by >Windows to Windows nameservers as follows: > >... > >When I do a nslookup or dig I only see the first two servers and not >sec2: >-- >ns-1: nslookup >> se

Re: BIND 9.6.0-P1 is now available (rob_aust...@isc.org)

2009-01-07 Thread bsfinkel
Echoing a complaint made recently -- I saw the announcements of the -P1 patch for the various supported versions of BIND via the bind-users digest. I used to get them also via some -announce list at ISC, I do not remember the name, maybe bind-annou...@isc.org . And I noticed that the list archive

Re: openssl alert when 9.8i installed?

2009-01-03 Thread bsfinkel
"aklist" wrote: >Thanks Jeremy: When you say "look at the output" is that captured >anywhere by default? I do I need to capture the output to a text file >when running >./configure? I watched it racing past in my terminal window but couldn't >follow it. I never build an executable without runnin

Re: DDNS and allow-update declarations

2008-12-10 Thread bsfinkel
Nicholas F Miller <[EMAIL PROTECTED]> wrote: >I have a couple of questions regarding how a Microsoft domain >controller updates a dynamic zone. > >1 ) When a domain controller tries to update the zone does it try the >DNS servers it has listed in its network settings or does it follow >the S

Re: Help understanding lame server error

2008-11-20 Thread bsfinkel
>20-Nov-2008 00:36:38.470 lame-servers: info: lame server resolving >'szi.szi.sv.gov.yu' (in 'szi.sv.gov.yu'?): 195.178.32.2#53 This message means that your DNS server sent a query for szi.szi.sv.gov.yu and through recursion was directed to the nameserver at IP address 195.178.32.2