Re: expected covering NSEC3, got an exact match

2011-10-07 Thread Chris Thompson
On Sep 22 2011, I wrote: There was some correspondence last year about this warning message, but this seems to be caused by something new. Since 2011-09-02 we have been seeing messages like this Sep 22 16:38:52 authdns1.csx.cam.ac.uk named[646]: dnssec: warning: client 149.20.58.131#52557:

Re: Experience with DDNS (RFC 2136)

2011-10-07 Thread JINMEI Tatuya / 神明達哉
At 06 Oct 2011 20:26:48 +0100, Chris Thompson c...@cam.ac.uk wrote: Are you willing to share the stories of your DDNS deployments, maybe including approximate number of zones, records, update frequencies, etc.? We converted all our regular DNS updating operations to use dynamic updates in

nsupdate on a Windows ec2 instance to update dynamic DNS isn't working

2011-10-07 Thread kallen
hello, i'm trying to update dynamic DNS for my windows ec2 instance by running BIND's nsupdate from the instance. it's not working. i'll show details below. anyone have any idea what's going on? what else i should look at or try? * nsupdate command reports no error * my BIND nameserver never

Re: Experience with DDNS (RFC 2136)

2011-10-07 Thread Phil Mayers
On 10/07/2011 06:43 PM, JINMEI Tatuya / 神明達哉 wrote: Maybe an off topic in this thread, but out of curiosity, is there any specific reason you don't use the database as the direct source of the zone with BIND 9's dlz or PowerDNS? In general it will be slower, and I can't speak for Chris but

Re: dnssec config sanity check

2011-10-07 Thread Paul B. Henson
On 10/5/2011 10:25 AM, michoski wrote: Your initial hope is what I missed comments on... Me too; didn't get any that's horribly broken because or any that looks good feedback, guess I'll just have to review it a couple more times and hope for the best. It is recommended that the transition

Re: Experience with DDNS (RFC 2136)

2011-10-07 Thread Evan Hunt
1. DNSSEC Of all of them, #1 and #6 were probably the most important. Note that this will be less of an issue in BIND 9.9: you can set up a DLZ master and configure a slave to do inline signing. -- Evan Hunt -- e...@isc.org Internet Systems Consortium, Inc.