Hi,
I'm currently playing around with generalized NOTIFY, as we are
deploying an agent for .ch/.li. I have a few questions about the current
implementation in BIND 9.21. From reading the documentation and code, my
understanding is that some parts are currently not configurable or not
implemented, but I'd like to confirm this before pestering anyone with
feature requests.
Is it possible to manually configure a notification endpoint for a zone,
to test the implementation while the parent does not yet publish DSYNC
records?
As far as I understand, BIND sends the notification immediately after
the CDS/CDNSKEY RRset changes and ignores `notify-defer`. This seems
potentially problematic if the notification recipient immediately
retrieves CDS/CDNSKEY from the authoritative servers: the updated RRset
may not yet have propagated to all secondaries. Is there currently any
way to configure such a delay for NOTIFY(CDS), e.g. by using
`zone-propagation-delay` or another setting?
Does BIND send only one notification after the CDS/CDNSKEY RRset
changes, or does/could it generate another notification at a later
point, e.g. when checking the parent DS RRset? I'm asking because
receiving a notification does not necessarily mean that the parent can
immediately process the requested change. For example, the parental
agent may temporarily be unable to act because of rate limiting, or
because it has cached state for the domain which currently prevents
another modification and may need another nudge later on.
RFC 9859 allows the NOTIFY sender to include the EDNS Report-Channel
option so that the notification agent can report processing problems
asynchronously. Is there a way to configure the Report-Channel for these
CDS NOTIFY packets? From the documentation I gather that
`send-report-channel` only applies to authoritative DNS responses.
Best regards,
Oli
--
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from
this list.
