dynamic update for views

2009-06-13 Thread Tech W.
Hi, I know how to dynamic update on a basic named config. but my named has views setup, how to dynamic update the records to each view? Can you point to me some resources? Thanks. Regards, Wah. Need a Holiday? Win a $10,000 Holiday of your choice. Enter now.http://us.lrd.yahoo.com/_ylc=

Re: nsec and nsec3 records

2009-06-13 Thread Evan Hunt
> Currently I'm using bind 9.4.x, with NSEC records, but looking to move > to 9.6.1, in fact my slaves are already 9.6.1, but my master isn't > yet. I've recently read where .org has been signed, and using NSEC3. I > thought it might be a good idea to resign my zones using NSEC3, but > was unaware

Re: "expected a exact match NSEC3, got a covering record"

2009-06-13 Thread Hauke Lampe
> --- 9.6.1 released --- > > 2607. [bug] named could incorrectly delete NSEC3 records for > empty nodes when processing a update request. > [RT #19749] I installed 9.6.1 with a cleaned zone and the problem has not reocurred. Thank you

Re: Validating a DNSSEC installation

2009-06-13 Thread Hauke Lampe
Erik Lotspeich wrote: > I now get the AD flag when querying external validating resolvers such > as the ones you mention. That's good. May your signatures never expire and your keys always be valid. > I believe that my BIND is configured properly to be a validating > resolver as well: > > # dig

Re: nsec and nsec3 records

2009-06-13 Thread R Dicaire
On Sat, Jun 13, 2009 at 10:03 PM, Evan Hunt wrote: > Why would you want them both?  If you don't mind the drawbacks of NSEC, > why take on the operational and computational burdens of NSEC3? I don't know why, I'm simply not knowledgeable enough in DNSSEC deployment. Currently I'm using bind 9.4.x,

Re: nsec and nsec3 records

2009-06-13 Thread Evan Hunt
> Can both nsec and nsec3 records be used simultaneously in a zone file, > or is it an either/or? Why would you want them both? If you don't mind the drawbacks of NSEC, why take on the operational and computational burdens of NSEC3? To answer the question, while I don't think the RFCs explicitly

Re: Tracking down validation failures

2009-06-13 Thread Chris Thompson
On Jun 12 20009, I wrote: [...] The debug level 2 messages, which correspond to SERVFAILs, are all associated with "8.84.in-addr.arpa", and it does seem that something is wrong with the (signed) delegation of that from "84.in-addr.arpa". I can reproduce the SERVFAIL effect on other validating na

Re: Slave DNS disconnect...

2009-06-13 Thread Jeff Lasman
On Friday 12 June 2009 09:33 pm, Jeff Lasman wrote: > We recently received a /24 from a provider who said they'd delegate > rDNS authority to our servers: .. Nevermind. Sorry to bother the list; the upstream tech now agrees with me. So may have been right. :) Jeff -- Jeff Lasman, Nobalo

nsec and nsec3 records

2009-06-13 Thread R Dicaire
Hi folks, Can both nsec and nsec3 records be used simultaneously in a zone file, or is it an either/or? Thanks -- aRDy Music and Rick Dicaire present: http://www.ardynet.com http://www.ardynet.com:9000/ardymusic.ogg.m3u ___ bind-users mailing list bind-

RE: Slave DNS disconnect...

2009-06-13 Thread Frank Bulk
(For pay) tools like the PTR trace from DNSreports do a very nice job of showing how the reverse is delegated, step by step. Frank -Original Message- From: bind-users-boun...@lists.isc.org [mailto:bind-users-boun...@lists.isc.org] On Behalf Of Jeff Lasman Sent: Friday, June 12, 2009 11:34

Re: Configuration for "hostname.bind."

2009-06-13 Thread Andrey G. Sergeev (AKA Andris)
Greetings, Sat, 13 Jun 2009 11:08:53 +0200 Chris Hills wrote: One can change the response to "version.bind. chaos txt" using the configuration directive "version". Is there an equivalent configuration directive for "hostname.bind. chaos txt"? Sure: options { hostname "any_text"; };

Re: Validating a DNSSEC installation

2009-06-13 Thread Erik Lotspeich
Hi Hauke, I now get the AD flag when querying external validating resolvers such as the ones you mention. I believe that my BIND is configured properly to be a validating resolver as well: # dig +adflag @ns.lotspeich.org. isc.org. ; <<>> DiG 9.6.1 <<>> +adflag @ns.lotspeich.org. isc.org. ; (1 s

Re: Configuration for "hostname.bind."

2009-06-13 Thread Chris Hills
On 13/06/09 11:39, Chris Hills wrote: /etc/named.conf:160: zone 'bind': class 'CHAOS' does not match view/default class /etc/named.conf:165: zone 'server': class 'CHAOS' does not match view/default class I resolved this by switching to a view configuration, i.e.:- view "external-chaos" chaos {

Re: Configuration for "hostname.bind."

2009-06-13 Thread Chris Hills
On 13/06/09 11:08, Chris Hills wrote: Hi One can change the response to "version.bind. chaos txt" using the configuration directive "version". Is there an equivalent configuration directive for "hostname.bind. chaos txt"? Also, is it possible to configure BIND to respond on version.server. chao

Configuration for "hostname.bind."

2009-06-13 Thread Chris Hills
Hi One can change the response to "version.bind. chaos txt" using the configuration directive "version". Is there an equivalent configuration directive for "hostname.bind. chaos txt"? Also, is it possible to configure BIND to respond on version.server. chaos txt and id.server. chaos txt in t