Re: Querying locally on a nameserver - odd behavior

2016-10-02 Thread blrmaani
On Wednesday, September 21, 2016 at 8:10:16 AM UTC-7, Graham Clinch wrote: > >>> I have a DNS server (which is both forwarder and authoritative NS) and I > >>> see this odd behavior locally on the host: > >>> > >>> dig @localhost # returns immediately with right response > >>> > >>> dig @

root zone on a nameserver which cannot reach root-servers

2016-10-02 Thread blrmaani
We have a DNS server setup where all zones are either slaves or forwards to a internal DNS servers which resolves external names. Questions: 1. Do we still need a root zone (type=hint) ? 2. What is the side effect of having root zone when our nameserver cannot reach root servers? (additional loa

Re: Multiple A Records - Followup Question

2016-10-02 Thread Reindl Harald
Am 03.10.2016 um 00:08 schrieb David Ford: On 2016-10-02 21:22, Reindl Harald wrote: Am 02.10.2016 um 22:42 schrieb David Ford: On 2016-10-02 12:59, Reindl Harald wrote: IOW, can a given *IP* appear in more than one A record? I realize that this does have the problem that the reverses wou

Re: Multiple A Records - Followup Question

2016-10-02 Thread David Ford
On 2016-10-02 21:22, Reindl Harald wrote: > > > Am 02.10.2016 um 22:42 schrieb David Ford: >> On 2016-10-02 12:59, Reindl Harald wrote: >>> IOW, can a given *IP* appear in more than one A record? I realize that this does have the problem that the reverses would resolve to hostX not

Re: debug SERVFAIL

2016-10-02 Thread Reindl Harald
Am 02.10.2016 um 23:24 schrieb Per olof Ljungmark: On 2016-10-02 22:09, Reindl Harald wrote: Am 02.10.2016 um 22:04 schrieb Maile Halatuituia: how about nslookup with set debug option i think would do besides the fact that when you think "nslookup" is the solution for anything you don't kno

Re: debug SERVFAIL

2016-10-02 Thread Per olof Ljungmark
On 2016-10-02 22:09, Reindl Harald wrote: > > > Am 02.10.2016 um 22:04 schrieb Maile Halatuituia: >> how about nslookup with set debug option i think would do > > besides the fact that when you think "nslookup" is the solution for > anything you don't know your problem you did not understand m

Re: Multiple A Records - Followup Question

2016-10-02 Thread Reindl Harald
Am 02.10.2016 um 22:42 schrieb David Ford: On 2016-10-02 12:59, Reindl Harald wrote: IOW, can a given *IP* appear in more than one A record? I realize that this does have the problem that the reverses would resolve to hostX not test on IP should only have on PTR - period avoid anything el

Re: Multiple A Records - Followup Question

2016-10-02 Thread David Ford
On 2016-10-02 12:59, Reindl Harald wrote: > >> IOW, can a given *IP* appear in more than one A record? I realize >> that this does have the problem that the reverses would resolve to >> hostX not >> test > > on IP should only have on PTR - period > > avoid anything else than PTR/A-matching if the m

Re: debug SERVFAIL

2016-10-02 Thread Reindl Harald
Am 02.10.2016 um 22:04 schrieb Maile Halatuituia: how about nslookup with set debug option i think would do besides the fact that when you think "nslookup" is the solution for anything you don't know your problem you did not understand my simple question: "dig" or "nslookup" or whatever i

Re: ip6tables with raw table(no conntrack) drop fragmented packet

2016-10-02 Thread Larry Larson
This is for recursive, and our recursive got 10X more queries than our authoritative ones, and we had to disable conntrack on our DNS servers last summer by using raw table and everything works for IPv4 including fragmentation, we just noticed fragment fails for IPv6 when using raw table, query not

RE: debug SERVFAIL

2016-10-02 Thread Maile Halatuituia
how about nslookup with set debug option i think would do From: bind-users on behalf of Reindl Harald Sent: Monday, October 3, 2016 8:34 AM To: bind-users@lists.isc.org Subject: Re: debug SERVFAIL Am 02.10.2016 um 21:25 schrieb Per olof Ljungmark: > Than

Re: debug SERVFAIL

2016-10-02 Thread Reindl Harald
Am 02.10.2016 um 21:25 schrieb Per olof Ljungmark: Thank you for all good advices, but I cannot refrain from commenting on the fact that nobody answered my real question, namely, A tip on how to generate debug output from "dig", in particular when investigating SERVFAIL. In my stupidity I thou

Re: debug SERVFAIL

2016-10-02 Thread Per olof Ljungmark
Hi, On 2016-10-02 20:41, Reindl Harald wrote: > > > Am 02.10.2016 um 20:32 schrieb Per olof Ljungmark: >> On 2016-10-02 19:22, Nico CARTRON wrote: >>> Hi Per, >>> On 2 Oct 2016, at 19:07, Per olof Ljungmark wrote: [...] > Just use the "hint" type configuration. This is j

Re: debug SERVFAIL

2016-10-02 Thread Reindl Harald
Am 02.10.2016 um 20:32 schrieb Per olof Ljungmark: On 2016-10-02 19:22, Nico CARTRON wrote: Hi Per, On 2 Oct 2016, at 19:07, Per olof Ljungmark wrote: [...] Just use the "hint" type configuration. This is just fine for most users. The interesting thing is why FreeBSD includes the recom

Re: debug SERVFAIL

2016-10-02 Thread Per olof Ljungmark
Hi, On 2016-10-02 19:22, Nico CARTRON wrote: > Hi Per, > >> On 2 Oct 2016, at 19:07, Per olof Ljungmark wrote: >> >> [...] >> >>> Just use the "hint" type configuration. This is just fine for most users. >> >> The interesting thing is why FreeBSD includes the recommendation in the >> default nam

Re: debug SERVFAIL

2016-10-02 Thread Nico CARTRON
Hi Per, > On 2 Oct 2016, at 19:07, Per olof Ljungmark wrote: > > [...] > >> Just use the "hint" type configuration. This is just fine for most users. > > The interesting thing is why FreeBSD includes the recommendation in the > default named.conf if that is not good, and I thought it would be

Re: debug SERVFAIL

2016-10-02 Thread Per olof Ljungmark
Hi, On 2016-10-02 17:51, Anand Buddhdev wrote: > On 02/10/16 17:22, Per olof Ljungmark wrote: > > Hello Per, > > Please see my answers below. You appear to have a bad configuration. Well, HAD a bad configuration as I just posted. >> Hmmm, looks like I've found something here. The default named

Re: debug SERVFAIL

2016-10-02 Thread Anand Buddhdev
On 02/10/16 17:22, Per olof Ljungmark wrote: Hello Per, Please see my answers below. You appear to have a bad configuration. > Hmmm, looks like I've found something here. The default named.conf on > FreeBSD has the following section on the root servers. If I comment out > the "traditional" root

Re: debug SERVFAIL

2016-10-02 Thread Per olof Ljungmark
On 2016-10-02 17:02, Reindl Harald wrote: > > > Am 02.10.2016 um 17:00 schrieb Per olof Ljungmark: >> On 2016-10-02 16:50, Reindl Harald wrote: >>> >>> >>> Am 02.10.2016 um 16:46 schrieb Per olof Ljungmark: What is the best way to debug a SERVFAIL problem? I have tried to ramp up the tr

Re: debug SERVFAIL

2016-10-02 Thread Reindl Harald
Am 02.10.2016 um 17:00 schrieb Per olof Ljungmark: On 2016-10-02 16:50, Reindl Harald wrote: Am 02.10.2016 um 16:46 schrieb Per olof Ljungmark: What is the best way to debug a SERVFAIL problem? I have tried to ramp up the trace level a lot but that did not return anything useful. It is onl

Re: debug SERVFAIL

2016-10-02 Thread Per olof Ljungmark
On 2016-10-02 16:50, Reindl Harald wrote: > > > Am 02.10.2016 um 16:46 schrieb Per olof Ljungmark: >> What is the best way to debug a SERVFAIL problem? I have tried to ramp >> up the trace level a lot but that did not return anything useful. >> >> It is only one zone in question, namely the PTR f

Re: debug SERVFAIL

2016-10-02 Thread Reindl Harald
Am 02.10.2016 um 16:46 schrieb Per olof Ljungmark: What is the best way to debug a SERVFAIL problem? I have tried to ramp up the trace level a lot but that did not return anything useful. It is only one zone in question, namely the PTR for our external subnet. What puzzles me the most is that

debug SERVFAIL

2016-10-02 Thread Per olof Ljungmark
Hi, What is the best way to debug a SERVFAIL problem? I have tried to ramp up the trace level a lot but that did not return anything useful. It is only one zone in question, namely the PTR for our external subnet. What puzzles me the most is that a secondary on the same subnet answers just fine f

Re: Multiple A Records - Followup Question

2016-10-02 Thread Reindl Harald
Am 02.10.2016 um 13:57 schrieb Tim Daneliuk: My earlier question was whether one host could have more than one A record. But say, I want to to this as follows: testA 1.2.3.4 testA 5.6.7.8 testA 9.10.11.12 Is this legit? surely - guess how dns-round-robin load balancing wo

Re: Multiple A Records - Followup Question

2016-10-02 Thread G.W. Haywood
Hi there, On Sun, 2 Oct 2016, Tim Daneliuk wrote: ... can a given *IP* appear in more than one A record? ... http://serverfault.com/questions/56539/dns-multiple-a-records-or-1-a-record-and-lots-of-cnames -- 73, Ged. ___ Please visit https://lists.

Multiple A Records - Followup Question

2016-10-02 Thread Tim Daneliuk
As a followup to my earlier question on have a single hostname with multiple A record, I want to understand a slightly different scenario. 3 hosts exist with canonical A records: hosta A 1.2.3.4 hostb A 5.6.7.8 hostc A 9.10.11.12 My earlier question was whether one host could have mor