nsupdate problem after DNSSEC

2011-01-05 Thread Michelle Konzack
I have update my dns1 to DNSSEC and now I have two probems...

1)  dns2 does not more update

2)  nsupdate from my admin website does not more work and give me   an
ExitStatus 2.  Unfortunately the manpage does not tell me what 2 is.
But I assume it hast the same problem like dns2

Can someone tell me what I have to change that my TSIG work again?

Thanks, Greetings and nice Day/Evening
Michelle Konzack

-- 
# Debian GNU/Linux Consultant ##
   Development of Intranet and Embedded Systems with Debian GNU/Linux

itsyst...@tdnet France EURL   itsyst...@tdnet UG (limited liability)
Owner Michelle KonzackOwner Michelle Konzack

Apt. 917 (homeoffice)
50, rue de Soultz Kinzigstraße 17
67100 Strasbourg/France   77694 Kehl/Germany
Tel: +33-6-61925193 mobil Tel: +49-177-9351947 mobil
Tel: +33-9-52705884 fix

http://www.itsystems.tamay-dogan.net/  http://www.flexray4linux.org/
http://www.debian.tamay-dogan.net/ http://www.can4linux.org/

Jabber linux4miche...@jabber.ccc.de

Linux-User #280138 with the Linux Counter, http://counter.li.org/


signature.pgp
Description: Digital signature
___
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Managing local and remote domains

2011-01-05 Thread Fidel Viegas

Hi everyone!

First and foremost, Happy New Year!

Secondly, this is my first post in this list and my first
question is part technical, part administrative. Basically,
I have hosted a webserver with a hosting company,
who also manages my domain. Now, I have decided to
setup a local mail server that is going to be part of the
domain managed by the hosting company (e.g. mail.domain.com).
That has been set ok, and it is all working. However,
I have also configured a local DNS to resolve our
internal names. The internal nameserver is setup as
a caching nameserver that forwards to the
hosting company's nameserver, and is also setup as
a primary nameserver that manages the zone for the
local domain (domain.local). That is all ok as well.
The problem comes when the managers decided that
they want the local domain the same as the
global domain (e.g. domain.com). We can't really setup the
global nameserver on our facilities because we experience quite a
lot of power outage and also have Internet connectivity
problems from time to time.

Can someone suggest me an approach to resolve this issue without
getting conflicts between the local nameserver
and the hosting company's nameserver?

Thanks in advance!

Best Regards,

Fidel.
___
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users


Re: nsupdate problem after DNSSEC upgrade

2011-01-05 Thread Michelle Konzack
Note:   My nsupdate script us an autogenerated file like:

if ($_GET['nsupdate'] == 'on') {
  $tmp_file = tempnam('/tmp', 'tdphp-vserver.');
  chmod($tmp_file, 0700);
  $fh = fopen($tmp_file, 'a');
  fwrite($fh, server dns1.tamay-dogan.net\n);
  fwrite($fh, update delete . $_GET['vhost'] .  A\n);
  fwrite($fh, prereq nxdomain . $_GET['vhost'] . \n);
  fwrite($fh, update add . $_GET['vhost'] .  86400 CNAME . 
$_SERVER['SERVER_NAME'] . \n);
  fwrite($fh, send\n);
  fseek($fh, 0);
  exec(nsupdate  . $tmp_file, $array, $ret);

but this give me as I sayed already an ExitStatus 2

Thanks, Greetings and nice Day/Evening
Michelle Konzack

-- 
# Debian GNU/Linux Consultant ##
   Development of Intranet and Embedded Systems with Debian GNU/Linux

itsyst...@tdnet France EURL   itsyst...@tdnet UG (limited liability)
Owner Michelle KonzackOwner Michelle Konzack

Apt. 917 (homeoffice)
50, rue de Soultz Kinzigstraße 17
67100 Strasbourg/France   77694 Kehl/Germany
Tel: +33-6-61925193 mobil Tel: +49-177-9351947 mobil
Tel: +33-9-52705884 fix

http://www.itsystems.tamay-dogan.net/  http://www.flexray4linux.org/
http://www.debian.tamay-dogan.net/ http://www.can4linux.org/

Jabber linux4miche...@jabber.ccc.de
ICQ#328449886

Linux-User #280138 with the Linux Counter, http://counter.li.org/


signature.pgp
Description: Digital signature
___
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Re: enable a dynamic zone

2011-01-05 Thread Phil Mayers

On 01/05/2011 03:32 AM, Paul Ooi Cong Jen wrote:

Hi,

Nope. Dynamic zone require keys exchange for zone transfer.


This is not correct.
___
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users


Re: Managing local and remote domains

2011-01-05 Thread Sten Carlsen
My method for solving this problem is to have a local DNS with two views:
- internal view (recursing), responding to internal clients with local
addresses
- external view (not recursing), that is used as a hidden master for my
DNS-provider

No forwarding, the local server does all its own resolving, the hidden
master controls all the outside servers.

The downside is that you must maintain both views, typically with
different data, unless you only have public addresses. Some management
tool might be a good solution for this.

The good side is that your laptop users will not have to know whether
they are inside or outside your network - e.g. your mailserver is
mail.domain.com in all cases, inside it has a 192.168.x.x address and
outside it has a.b.c.d so mail programs never see any difference.

On 05/01/11 9:17, Fidel Viegas wrote:
 Hi everyone!

 First and foremost, Happy New Year!

 Secondly, this is my first post in this list and my first
 question is part technical, part administrative. Basically,
 I have hosted a webserver with a hosting company,
 who also manages my domain. Now, I have decided to
 setup a local mail server that is going to be part of the
 domain managed by the hosting company (e.g. mail.domain.com).
 That has been set ok, and it is all working. However,
 I have also configured a local DNS to resolve our
 internal names. The internal nameserver is setup as
 a caching nameserver that forwards to the
 hosting company's nameserver, and is also setup as
 a primary nameserver that manages the zone for the
 local domain (domain.local). That is all ok as well.
 The problem comes when the managers decided that
 they want the local domain the same as the
 global domain (e.g. domain.com). We can't really setup the
 global nameserver on our facilities because we experience quite a
 lot of power outage and also have Internet connectivity
 problems from time to time.

 Can someone suggest me an approach to resolve this issue without
 getting conflicts between the local nameserver
 and the hosting company's nameserver?

 Thanks in advance!

 Best Regards,

 Fidel.
 ___
 bind-users mailing list
 bind-users@lists.isc.org
 https://lists.isc.org/mailman/listinfo/bind-users

-- 
Best regards

Sten Carlsen

No improvements come from shouting:

   MALE BOVINE MANURE!!! 

___
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Re: enable a dynamic zone

2011-01-05 Thread Phil Mayers

On 01/05/2011 03:01 AM, p...@mail.nsbeta.info wrote:


Hello,

When adding a statement of something like:

allow-update { 127.0.0.1; };

to the zone configuration, this zone will become a dynamic zone, is it?


Yes.

You can also do:

allow-update { key NAME; };

...and in newer versions of bind IIRC you can use an auto-generated rndc 
key, but I can't remember the syntax.

___
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users


Re: nsupdate problem after DNSSEC

2011-01-05 Thread Phil Mayers

On 01/05/2011 08:09 AM, Michelle Konzack wrote:

I have update mydns1  to DNSSEC and now I have two probems...


Do you mean you have signed your zone?

If so, you are aware that bind requires the zone-signing key to be 
available in order to perform updates - like this:


zone $name {
  type master;
  allow-update { ... };
  key-directory /var/named/data/keys/$name;
};

...and in /var/named/data/keys/$name you need the:

K$name.+005+id.key
K$name.+005+id.private

...files?
___
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users


Re: enable a dynamic zone

2011-01-05 Thread Sten Carlsen
Maybe just a detail without much significance. Will the zone become
dynamic when you enable updates OR when you have actually done the first
update - i.e. created the .jnl file?

On 05/01/11 10:15, Phil Mayers wrote:
 On 01/05/2011 03:01 AM, p...@mail.nsbeta.info wrote:

 Hello,

 When adding a statement of something like:

 allow-update { 127.0.0.1; };

 to the zone configuration, this zone will become a dynamic zone, is it?

 Yes.

 You can also do:

 allow-update { key NAME; };

 ...and in newer versions of bind IIRC you can use an auto-generated
 rndc key, but I can't remember the syntax.
 ___
 bind-users mailing list
 bind-users@lists.isc.org
 https://lists.isc.org/mailman/listinfo/bind-users

-- 
Best regards

Sten Carlsen

No improvements come from shouting:

   MALE BOVINE MANURE!!! 

___
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Re: enable a dynamic zone

2011-01-05 Thread Phil Mayers

On 01/05/2011 11:45 AM, Sten Carlsen wrote:

  Maybe just a detail without much significance. Will the zone become
dynamic when you enable updates OR when you have actually done the first
update - i.e. created the .jnl file?


A dynamic zone is a zone that allows dynamic updates, so the former. You 
don't need a .jnl file, and can remove it (provided you have flushed the 
updates and don't need the IXFR history) and it'll still be dynamic.


Another example, if you dnssec sign a zone, but leave it as static, then 
later set:


auto-dnssec maintain;

...and

zone name {
  allow-update { ... };
}

...the zone will start to be looked at for DNSSEC signature 
maintenance as soon as you do an rndc reconfig. It might take minutes, 
hours or days before a re-signing occurs, but it's dynamic immediately.


But I guess it's a matter of terminology.
___
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users


Re: nsupdate problem after DNSSEC

2011-01-05 Thread Michelle Konzack
Hello Phil Mayers,

Am 2011-01-05 09:19:11, hacktest Du folgendes herunter:
 Do you mean you have signed your zone?

Yes

 If so, you are aware that bind requires the zone-signing key to be
 available in order to perform updates - like this:
 
 zone $name {
   type master;
   allow-update { ... };

allow-update or allow-transfer?

I have the later one and it seems, my zones  where  transfered  after  a
forced reboot of dns2,  but  only  the  ZONEs  which  have  an  IP  in
allow-transfer.  tamay-dogan.net use a key and it does not work.

   key-directory /var/named/data/keys/$name;
 };

Ahh, I have to add this?

 ...and in /var/named/data/keys/$name you need the:
 
 K$name.+005+id.key
 K$name.+005+id.private

many of them

Thanks, Greetings and nice Day/Evening
Michelle Konzack

-- 
# Debian GNU/Linux Consultant ##
   Development of Intranet and Embedded Systems with Debian GNU/Linux

itsyst...@tdnet France EURL   itsyst...@tdnet UG (limited liability)
Owner Michelle KonzackOwner Michelle Konzack

Apt. 917 (homeoffice)
50, rue de Soultz Kinzigstraße 17
67100 Strasbourg/France   77694 Kehl/Germany
Tel: +33-6-61925193 mobil Tel: +49-177-9351947 mobil
Tel: +33-9-52705884 fix

http://www.itsystems.tamay-dogan.net/  http://www.flexray4linux.org/
http://www.debian.tamay-dogan.net/ http://www.can4linux.org/

Jabber linux4miche...@jabber.ccc.de
ICQ#328449886

Linux-User #280138 with the Linux Counter, http://counter.li.org/


signature.pgp
Description: Digital signature
___
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Re: bind slave not get DNS update

2011-01-05 Thread Robert Spangler
On Tuesday 04 January 2011 20:50, Steve Zeng wrote:

  I don't have NS record for both of the slaves (windows DNS slave and Linux
 DNS slave). I use also-notify and it works for Windows DNS slave. But not
 for BIND/Linux.

Is SELinux running on this system?  I seen you are running CentOS and in the 
RH setting of SELinux  Bind is only allowed to make changes is certain 
directories.

Please don't include me directly in your replies as I get the mailing list 
also.  Thnx.


-- 

Regards
Robert

Linux
The adventure of a life time.

Linux User #296285
Get Counted
http://counter.li.org/
___
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users


RE: bind slave not get DNS update

2011-01-05 Thread Steve Zeng
Rndc transfer (initialized at the slave side) works fine...

Steve


-Original Message-
From: Paul Ooi Cong Jen [mailto:paul...@takizo.com] 
Sent: Tuesday, January 04, 2011 6:01 PM
To: Steve Zeng
Cc: Robert Spangler; bind-users@lists.isc.org
Subject: Re: bind slave not get DNS update

Steve, 

If you run rndc transfer from Linux bind, what do you see? 

--
Paul Ooi



On 05-Jan-2011, at 9:50 AM, Steve Zeng wrote:

 I don't have NS record for both of the slaves (windows DNS slave and Linux 
 DNS slave). I use also-notify and it works for Windows DNS slave. But not 
 for BIND/Linux.
 
also-notify {
B.B.B.B;# public IP of first 
 DNS slave(windows DNS)
C.C.C.C;# public IP of second 
 DNS slave(Linux BIND DNS)
};
 
 Thanks, 
 
 Steve
 
 -Original Message-
 From: bind-users-bounces+stevez=airg@lists.isc.org 
 [mailto:bind-users-bounces+stevez=airg@lists.isc.org] On Behalf Of Robert 
 Spangler
 Sent: Tuesday, January 04, 2011 5:29 PM
 To: bind-users@lists.isc.org
 Subject: Re: bind slave not get DNS update
 
 On Tuesday 04 January 2011 19:43, Steve Zeng wrote:
 
 We have a BIND DNS master and Windows DNS slave running for a while. I
 recently configured a second DNS slave running on Linux/Centos. When I
 stop/start the second DNS slave. It gets all zone files correctly. However,
 it does not get update when I make a zone file modification and increased
 the sn on the master. The odd thing is, I don't see any xfer-out log in the
 master(I do see the xfer-out log for the windows DNS slave, though).
 Googling around and search BIND maillist archive does not get much clue
 either... any hint is greatly appreciated..
 
 Is there an NS record in the zone files for the newly added DNS server?  If 
 not then you are going to have to add either a Notify statement in the master 
 config for the new server or add it as an NS record to the zone file.  This 
 is how the Master knows who to inform of changes.
 
 
 -- 
 
 Regards
 Robert
 
 Linux
 The adventure of a life time.
 
 Linux User #296285
 Get Counted
 http://counter.li.org/
 ___
 bind-users mailing list
 bind-users@lists.isc.org
 https://lists.isc.org/mailman/listinfo/bind-users
 ___
 bind-users mailing list
 bind-users@lists.isc.org
 https://lists.isc.org/mailman/listinfo/bind-users

___
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users


nslookup Got recursion not available from... trying next server

2011-01-05 Thread vr


I'm having a query problem and hope I'm at the right mailing list...

I get a recursion not available message intermittently when using 
nslookup. The message will appear on the first query, presumably to 
un-cached IP/hostname and subsequent queries to the same IP/hostname 
will succeed without the message.


The client is Debian Lenny, package 1:9.6.ESVR1+dfsg-0+lenny2.
The clients /etc/resolv.conf has two nameserver entries pointing to 
two internal DNS servers which are Windows 2003SP2. Both the client and 
the servers are on the same subnet and switch as the client performing 
nslookups. I have confirmed the two DNS servers have recursion enabled.
Changing the order in the Debian clients resolv.conf does not modify 
or correct the behavior of nslookup.


Using another Debian Lenny client to query the Windows 2003 servers 
reproduces the message in the same intermittent fashion.


Using other Debian Lenny clients to other Debian BIND servers (unsure 
of package version) on other networks reproduces the recursion not 
available message. (always with nslookup)


I originally stumbled upon this query problem because my Postfix 
instance would also intermittently fail lookups and log them to 
mail.log. I found information in the Postfix archives that Postfix uses 
the libraries of the host so I turned to nslookup to troubleshoot 
queries.


I have not been able to receive the recursion not available message 
while using dig.


Is this recursion not available message a known issue?

Since I'm seeing this recursion message in more than one environment, 
how would I, and my installed applications, get more consistent 
successful queries out of the respective systems?


___
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users


Re: nslookup Got recursion not available from... trying next server

2011-01-05 Thread Niall O'Reilly
On 05/01/11 21:36, vr wrote:
 I'm having a query problem and hope I'm at the right mailing list...

Formally, probably not, since what you describe isn't a BIND
issue.  That said, the people on this list are likely among
those who can best give you helpful advice.

 I get a recursion not available message intermittently when using
 nslookup.

The short answer is, Yes indeed: that's how DNS works.
A longer answer follows below.

I should mention first that I have no experience using
'nslookup'.  I understand that it has a reputation for masking
the information actually needed for troubleshooting by trying
too hard to be helpful.  I don't actually know whether this
reputation is deserved.

I suggest you use 'dig' instead.  I count myself lucky that
this was the first DNS troubleshooting tool I was introduced to
by our then Internet expert nearly 20 years ago. [Thanks,
Mike!]  I've never felt the need to use another, and probably
haven't even yet discovered all of its features.

 The message will appear on the first query, presumably to
 un-cached IP/hostname and subsequent queries to the same IP/hostname
 will succeed without the message.

It is normal, and actually good practice, for any authoritative
name server (the master or slave for a given zone) to be
configured to refuse to provide recursive name service.
I guess that 'nslookup' is by default making a recursive query,
happens to send that query to an authoritative server, receives
a response in which the recursion not available flag is set,
and duly displays a message which appears at first sight to be
disturbing.

As it happens, 'dig' also makes a recursive query by default,
although it's easy to tell it not to.  Besides, 'dig' just
shows the flags; it doesn't convert them into potentially
disturbing messages.

I hope this helps.


Best regards,

Niall O'Reilly
University College Dublin IT Services
___
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users


Re: bind slave not get DNS update

2011-01-05 Thread Niall O'Reilly
On 05/01/11 01:50, Steve Zeng wrote:
 I don't have NS record for both of the slaves (windows DNS slave and
 Linux DNS slave). I use also-notify and it works for Windows DNS
 slave. But not for BIND/Linux.

On 05/01/11 19:56, Steve Zeng wrote:
 Rndc transfer (initialized at the slave side) works fine...

Good.  Manual intervention works.

I suggest you try to determine the following from your logs
on both master and (Linux) slave.

Whether the master is sending the NOTIFY.
Whether the slave is receiving the NOTIFY.
Whether the slave is acting on the NOTIFY.

That should make it clear what's not happening without
manual intervention.


Best regards,
Niall O'Reilly
___
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users


RE: bind slave not get DNS update

2011-01-05 Thread Steve Zeng
Tcpdump on master(A.A.A.A) shows the following:

23:59:54.788272 IP A.A.A.A.domain  C.C.C.C.domain:  26512 notify [b23=0x2400] 
[1a] SOA? mydomain.com. (72)
23:59:54.788898 IP C.C.C.C.domain  A.A.A.A.domain:  26512 notify Refused- 
0/0/0 (26)

So it looks like master did sent notify out but refused by BIND slave
also-notify {
   B.B.B.B;# public IP of first DNS 
slave(windows DNS)
   C.C.C.C;# public IP of second DNS 
slave(Linux BIND DNS)
};

Steve

-Original Message-
From: bind-users-bounces+stevez=airg@lists.isc.org 
[mailto:bind-users-bounces+stevez=airg@lists.isc.org] On Behalf Of Niall 
O'Reilly
Sent: Wednesday, January 05, 2011 3:33 PM
To: bind-users@lists.isc.org
Subject: Re: bind slave not get DNS update

On 05/01/11 01:50, Steve Zeng wrote:
 I don't have NS record for both of the slaves (windows DNS slave and
 Linux DNS slave). I use also-notify and it works for Windows DNS
 slave. But not for BIND/Linux.

On 05/01/11 19:56, Steve Zeng wrote:
 Rndc transfer (initialized at the slave side) works fine...

Good.  Manual intervention works.

I suggest you try to determine the following from your logs
on both master and (Linux) slave.

Whether the master is sending the NOTIFY.
Whether the slave is receiving the NOTIFY.
Whether the slave is acting on the NOTIFY.

That should make it clear what's not happening without
manual intervention.


Best regards,
Niall O'Reilly
___
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
___
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users


Re: bind slave not get DNS update

2011-01-05 Thread Mark Andrews

In message 8b5c6f575422414aa91b46c454126b6c02666af...@exchmvs.exchange.airg, 
Steve Zeng writes:
 Tcpdump on master(A.A.A.A) shows the following:

And what source address does the slave see?  
 
 23:59:54.788272 IP A.A.A.A.domain  C.C.C.C.domain:  26512 notify [b23=0x240
 0] [1a] SOA? mydomain.com. (72)
 23:59:54.788898 IP C.C.C.C.domain  A.A.A.A.domain:  26512 notify Refused- 0/
 0/0 (26)
 
 So it looks like master did sent notify out but refused by BIND slave
 also-notify {
B.B.B.B;# public IP of first DNS slave(win
 dows DNS)
C.C.C.C;# public IP of second DNS slave(Li
 nux BIND DNS)
 };
 
 Steve
 
 -Original Message-
 From: bind-users-bounces+stevez=airg@lists.isc.org [mailto:bind-users-bou
 nces+stevez=airg@lists.isc.org] On Behalf Of Niall O'Reilly
 Sent: Wednesday, January 05, 2011 3:33 PM
 To: bind-users@lists.isc.org
 Subject: Re: bind slave not get DNS update
 
 On 05/01/11 01:50, Steve Zeng wrote:
  I don't have NS record for both of the slaves (windows DNS slave and
  Linux DNS slave). I use also-notify and it works for Windows DNS
  slave. But not for BIND/Linux.
 
 On 05/01/11 19:56, Steve Zeng wrote:
  Rndc transfer (initialized at the slave side) works fine...
 
   Good.  Manual intervention works.
 
   I suggest you try to determine the following from your logs
   on both master and (Linux) slave.
 
   Whether the master is sending the NOTIFY.
   Whether the slave is receiving the NOTIFY.
   Whether the slave is acting on the NOTIFY.
 
   That should make it clear what's not happening without
   manual intervention.
 
 
   Best regards,
   Niall O'Reilly
 ___
 bind-users mailing list
 bind-users@lists.isc.org
 https://lists.isc.org/mailman/listinfo/bind-users
 ___
 bind-users mailing list
 bind-users@lists.isc.org
 https://lists.isc.org/mailman/listinfo/bind-users
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742 INTERNET: ma...@isc.org
___
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users


RE: bind slave not get DNS update

2011-01-05 Thread Steve Zeng
On slave, it sees the public IPs. tcpdump shows:

01:38:51.035945 IP A.A.A.A.domain  C.C.C.C.domain:  7545 notify [b23=0x2400] 
[1a] SOA? airg.com. (72)
01:38:51.036174 IP C.C.C.C.domain  A.A.A.A.domain:  7545 notify Refused- 0/0/0 
(26)

Steve

-Original Message-
From: Mark Andrews [mailto:ma...@isc.org] 
Sent: Wednesday, January 05, 2011 5:36 PM
To: Steve Zeng
Cc: bind-users@lists.isc.org
Subject: Re: bind slave not get DNS update


In message 8b5c6f575422414aa91b46c454126b6c02666af...@exchmvs.exchange.airg, 
Steve Zeng writes:
 Tcpdump on master(A.A.A.A) shows the following:

And what source address does the slave see?  
 
 23:59:54.788272 IP A.A.A.A.domain  C.C.C.C.domain:  26512 notify [b23=0x240
 0] [1a] SOA? mydomain.com. (72)
 23:59:54.788898 IP C.C.C.C.domain  A.A.A.A.domain:  26512 notify Refused- 0/
 0/0 (26)
 
 So it looks like master did sent notify out but refused by BIND slave
 also-notify {
B.B.B.B;# public IP of first DNS slave(win
 dows DNS)
C.C.C.C;# public IP of second DNS slave(Li
 nux BIND DNS)
 };
 
 Steve
 
 -Original Message-
 From: bind-users-bounces+stevez=airg@lists.isc.org [mailto:bind-users-bou
 nces+stevez=airg@lists.isc.org] On Behalf Of Niall O'Reilly
 Sent: Wednesday, January 05, 2011 3:33 PM
 To: bind-users@lists.isc.org
 Subject: Re: bind slave not get DNS update
 
 On 05/01/11 01:50, Steve Zeng wrote:
  I don't have NS record for both of the slaves (windows DNS slave and
  Linux DNS slave). I use also-notify and it works for Windows DNS
  slave. But not for BIND/Linux.
 
 On 05/01/11 19:56, Steve Zeng wrote:
  Rndc transfer (initialized at the slave side) works fine...
 
   Good.  Manual intervention works.
 
   I suggest you try to determine the following from your logs
   on both master and (Linux) slave.
 
   Whether the master is sending the NOTIFY.
   Whether the slave is receiving the NOTIFY.
   Whether the slave is acting on the NOTIFY.
 
   That should make it clear what's not happening without
   manual intervention.
 
 
   Best regards,
   Niall O'Reilly
 ___
 bind-users mailing list
 bind-users@lists.isc.org
 https://lists.isc.org/mailman/listinfo/bind-users
 ___
 bind-users mailing list
 bind-users@lists.isc.org
 https://lists.isc.org/mailman/listinfo/bind-users
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742 INTERNET: ma...@isc.org
___
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users


AUTO: Nicht erreichbar bis 11.1.2011 / Out of Office until 11.1.2011

2011-01-05 Thread Joachim Strohbach

Ich bin abwesend und kehre am 12.01.2011 zurück.


Danke für Ihre E-Mail-Nachricht.
Ich bin bis 11. Januar 2011 nicht im Büro.
In dringenden Angelegenheiten kontaktieren Sie bitte DENIC IT-Services
(E-Mail: i...@denic.de, Tel: (069) 27235-160 oder -250).
-
Thank you for your email message.
I am not in the office until 11 January 2011.
In urgent cases please contact DENIC IT-Services
(e-mail: i...@denic.de, Tel: +49 69 27235-160 or -250).

--
Joachim Strohbach
Leiter IT-Services / Head of IT-Services

DENIC eG
Kaiserstraße 75-77
60329 Frankfurt am Main
GERMANY

E-Mail: strohb...@denic.de
Fon: +49 69 27235-123
Fon: +49 69 27235-160 (Assistance)
Fon: +49 69 27235-250 (IT-Services)
Fax: +49 69 27235-239
SIP-URI: sip:1...@denic.de
http://www.denic.de

PGP-KeyID: 0x7A8A00FF, Fingerprint: 30AB 0F15 17D3 995F CA50  F0A8 EA30 B915 
7A8A 00FF

Angaben nach § 25a Absatz 1 GenG:
DENIC Domain Verwaltungs- und Betriebsgesellschaft eG (Sitz: Frankfurt am Main)
Vorstand: Sabine Dolderer, Helga Krüger, Carsten Schiefner, Dr. Jörg Schweiger
Vorsitzender des Aufsichtsrats: Elmar Knipp
Eingetragen unter Nr. 770 im Genossenschaftsregister, Amtsgericht Frankfurt am 
Main



Hinweis: Dies ist eine automatische Antwort auf Ihre Nachricht  nslookup Got 
recursion not available from... trying next server gesendet am 5.1.11
22:36:42.

Diese ist die einzige Benachrichtigung, die Sie empfangen werden, während diese 
Person abwesend ist.

___
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users