Re: blockhole'd IP receiving referral?

2009-12-18 Thread Chris Buxton
On Dec 18, 2009, at 12:33 PM, Len Conrad wrote: > bind 9.6.1-P1 > > named-checkconf /etc/namedb/named.conf > ... ok > > (in global options) > > options { > allow-recursion { mynets; }; > blackhole { !mynets; }; > }; I could be wrong, but wouldn't that be: blackhole

Re: blockhole'd IP receiving referral?

2009-12-18 Thread Jeremy C. Reed
On Fri, 18 Dec 2009, Len Conrad wrote: > dig'ging from a !mynets IP receives a referral to rather than > time-out/silence. Please show us. Does dig and tcpdump (or other packet trace) show where the response actually comes from? ___ bind-users mailing

blockhole'd IP receiving referral?

2009-12-18 Thread Len Conrad
bind 9.6.1-P1 named-checkconf /etc/namedb/named.conf ... ok (in global options) options { allow-recursion { mynets; }; blackhole { !mynets; }; }; dig'ging from a !mynets IP receives a referral to rather than time-out/silence. dig'ging from a mynets IP receives an answer.

Re: dnssec updated zone data is not live ??

2009-12-18 Thread Chris Thompson
On Dec 18 2009, Alan Clegg wrote: Niobos wrote: On 17 Dec 2009, at 20:50, Kevin Darcy wrote: Cat'ing the zone file is no longer reliable once you've enabled a zone for Dynamic Update. There might be updates in the log file which haven't been committed to the actual zone file yet. That's why I

Re: dnssec updated zone data is not live ??

2009-12-18 Thread Alan Clegg
Niobos wrote: On 17 Dec 2009, at 20:50, Kevin Darcy wrote: Cat'ing the zone file is no longer reliable once you've enabled a zone for Dynamic Update. There might be updates in the log file which haven't been committed to the actual zone file yet. That's why I recommended that you use an AXFR of

Re: dnssec updated zone data is not live ??

2009-12-18 Thread Niobos
On 17 Dec 2009, at 20:50, Kevin Darcy wrote: > Cat'ing the zone file is no longer reliable once you've enabled a zone for > Dynamic Update. There might be updates in the log file which haven't been > committed to the actual zone file yet. That's why I recommended that you use > an AXFR of the zo