in-addr.arpa insecure?

2013-03-01 Thread Robert Moskowitz
I got tipped off about this from logwatch report. On my public DNS server had the following: Feb 26 04:02:04 onlo named[19336]: validating @0xb2929ee0: in-addr.arpa SOA: got insecure response; parent indicates it should be secure Feb 27 04:02:04 onlo named[32262]: validating @0xb37e25e0:

Re: in-addr.arpa insecure?

2013-03-01 Thread Tony Finch
Robert Moskowitz r...@htt-consult.com wrote: I got tipped off about this from logwatch report. On my public DNS server had the following: Feb 26 04:02:04 onlo named[19336]: validating @0xb2929ee0: in-addr.arpa SOA: got insecure response; parent indicates it should be secure Looks like

Re: in-addr.arpa insecure?

2013-03-01 Thread Robert Moskowitz
On 03/01/2013 08:57 AM, Tony Finch wrote: Robert Moskowitz r...@htt-consult.com wrote: I got tipped off about this from logwatch report. On my public DNS server had the following: Feb 26 04:02:04 onlo named[19336]: validating @0xb2929ee0: in-addr.arpa SOA: got insecure response; parent

Re: in-addr.arpa insecure?

2013-03-01 Thread Robert Moskowitz
On 03/01/2013 09:22 AM, Michael W. Lucas wrote: On Fri, Mar 01, 2013 at 09:19:42AM -0500, Robert Moskowitz wrote: On 03/01/2013 08:57 AM, Tony Finch wrote: Robert Moskowitz r...@htt-consult.com wrote: I got tipped off about this from logwatch report. On my public DNS server had the

Re: in-addr.arpa insecure?

2013-03-01 Thread Robert Moskowitz
On 03/01/2013 09:22 AM, Michael W. Lucas wrote: On Fri, Mar 01, 2013 at 09:19:42AM -0500, Robert Moskowitz wrote: On 03/01/2013 08:57 AM, Tony Finch wrote: Robert Moskowitz r...@htt-consult.com wrote: I got tipped off about this from logwatch report. On my public DNS server had the

Re: in-addr.arpa insecure?

2013-03-01 Thread Robert Moskowitz
On 03/01/2013 09:19 AM, Robert Moskowitz wrote: On 03/01/2013 08:57 AM, Tony Finch wrote: Robert Moskowitz r...@htt-consult.com wrote: I got tipped off about this from logwatch report. On my public DNS server had the following: Feb 26 04:02:04 onlo named[19336]: validating @0xb2929ee0:

bad zone transfer request of reverse addr zone

2013-03-01 Thread Robert Moskowitz
I get this for all my secondaries for my reverse domain: client 63.68.132.50 view external: bad zone transfer request: '192-26.67.83.208.in-addr.arpa/IN': non-authoritative zone (NOTAUTH): 23 Time(s) I don't get this for my forward domain and the SOA for both are similarly structured. For

cname record

2013-03-01 Thread Dwayne Hottinger
I would like for users inside my network to not be able to do ssl searches with google, because of cipa compliance issues. I added a cname record to my zone file: www.google.com CNAME nosslsearch.google.com To try and get it to redirect. Since Im not authoritive for google, I dont think this

Re: cname record

2013-03-01 Thread Chuck Swiger
Hi, Dwayne-- On Mar 1, 2013, at 10:29 AM, Dwayne Hottinger wrote: I would like for users inside my network to not be able to do ssl searches with google, because of cipa compliance issues. OK, so you should block port tcp/443 to Google's network addresses (approximately 173.194.79.0/24) on

Re: bad zone transfer request of reverse addr zone

2013-03-01 Thread Robert Moskowitz
On 03/01/2013 01:03 PM, Robert Moskowitz wrote: I get this for all my secondaries for my reverse domain: client 63.68.132.50 view external: bad zone transfer request: '192-26.67.83.208.in-addr.arpa/IN': non-authoritative zone (NOTAUTH): 23 Time(s) I don't get this for my forward domain and

forwarding query-source (was Re: name caching and forwarding)

2013-03-01 Thread Lawrence K. Chen, P.Eng.
This reminds me of a problem that I've been having, that came up again recently. I thought I had read somewhere the query-source default is to try making queries from all the IPs on my system. And, my DNS servers have two IPs on themusing policy based routing, the first IP routes out on my

Bind not caching AAAA records

2013-03-01 Thread Stephen Wood
Hello. I have bind set up as a cache and forwarder only. I am having trouble getting bind to cache records. I can see from the rndc stats file that A records are being cached quite nicely, but all requests are flowing through to the upstream servers. Here's a snippet from my stats

Re: bad zone transfer request of reverse addr zone

2013-03-01 Thread Mark Andrews
In message 5130fba0.3020...@htt-consult.com, Robert Moskowitz writes: On 03/01/2013 01:50 PM, Jan-Piet Mens wrote: I get this for all my secondaries for my reverse domain: client 63.68.132.50 view external: bad zone transfer request: '192-26.67.83.208.in-addr.arpa/IN':

Re: Bind not caching AAAA records

2013-03-01 Thread Mark Andrews
In message CAEy9Ut5ooYJCcSXi3aHCnZz5vD578yqsBpNoTzw3Xmh=bzm...@mail.gmail.com , Stephen Wood writes: Hello. I have bind set up as a cache and forwarder only. I am having trouble getting bind to cache records. I can see from the rndc stats file that A records are being cached quite

Re: Bind not caching AAAA records

2013-03-01 Thread Stephen Wood
Thank you for the response, Mark! It's comforting to know that it's not something I have misconfigured on my end. Just a followup question, can you point me in a direction for learning about what a good or cachable answer would be? How do I ascertain the quality of results I'm getting from

Re: Bind not caching AAAA records

2013-03-01 Thread Mark Andrews
In message caey9ut761zwgkmvb4jtxc-fppwe4duxdwlogjxetgw-rw6p...@mail.gmail.com , Stephen Wood writes: Thank you for the response, Mark! It's comforting to know that it's not something I have misconfigured on my end. Just a followup question, can you point me in a direction for learning