Re: ipv4, ipV6 DNS BIND configuration and deployment

2013-08-06 Thread Mark Andrews
In message <5201cce6.2040...@pacbell.net>, Eduardo Bonsi writes: > Dear Noel and Mark, > > Thanks for your input! > > After thinking about the ipv6 network configuration pros and cons, I > decided to go for the ULA for my internal network and use the /64 > creating static ips for my WAN. To ge

Re: ipv4, ipV6 DNS BIND configuration and deployment

2013-08-06 Thread Eduardo Bonsi
Dear Noel and Mark, Thanks for your input! After thinking about the ipv6 network configuration pros and cons, I decided to go for the ULA for my internal network and use the /64 creating static ips for my WAN. To get a set of ULA addresses I logged to: http://www.simpledns.com/private-ipv6.a

Re: DNSSEC troubleshooting on a recursive server.

2013-08-06 Thread Mark Andrews
When diagnosing DNSSEC problems you need to chase the trust chain from DS record to the DNSKEY RRset to the answer RRset. ; <<>> DiG 9.10.0pre-alpha <<>> ds zygo.com +dnssec ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 65065 ;; flags: qr rd ra ad; QUE

Re: DNSSEC troubleshooting on a recursive server.

2013-08-06 Thread Ryan Pavely
I haven't had a chance to sit down an fully investigate however a few weeks ago I was forced to disable dnssec on the nac.net zone. We use inline signing and for whatever reason our secondary (ns2) machine was giving out stale copies of the zone. Nuking the zone and related files, restarting

DNSSEC troubleshooting on a recursive server.

2013-08-06 Thread Grant Keller
Hello, We have 7 recursive DNS servers running Bind 9.9.2, and we are seeing some strange behavoir validating DNSSEC. We have seen this happen a few times, and in the past the problem has gone away when the server is rebooted, so my first guess is that some record is stuck in the cache. An example