Re: BIND on CentOS: Nameservers for two domains

2010-09-28 Thread Kevin Darcy
This is more of a registry/registrar question than a BIND/DNS question. About the only _generic_ advice I can give you -- since you obscured the domain names and the relevant addresses, so I can't actually check anything on my own -- is to query the .eu servers directly for the delegation

Re: Is 10.in-addr.arpa not recommended?

2010-09-28 Thread Kevin Darcy
On 9/27/2010 8:48 PM, donovan jeffrey j wrote: I run a number of internal clients on 10 address space. what i did was break up each Zone into Class B's 10.1.x.x , 10.2.x.x then my forward and reverse files into class C's. Each record 10.1.1.x . 10.1.2.x, 10.1.3.x, . then scale ass needed.

Re: Round robin DNS query response

2010-09-29 Thread Kevin Darcy
On 9/29/2010 12:37 AM, SW wrote: Hi everyone... I am rather new to the world of DNS so I'm hoping to get some of your expertise... Is there a way to make BIND respond DNS query in sequence? For example, if I assign 2 IP addresses to an A record, is it possible to have it respond like...

Re: per-zone-recursion?

2010-09-30 Thread Kevin Darcy
Per-zone recursion control doesn't exist in BIND, because frankly it doesn't make sense. Either a zone type is meaningless *without* recursion (type forward, type stub), or recursion is *unnecessary* because the nameserver answers from authoritative data (type master, type slave). Put

Re: Unable to query the nameserver

2010-10-06 Thread Kevin Darcy
On 10/5/2010 3:49 PM, Dotan Cohen wrote: On Tue, Oct 5, 2010 at 20:30, Eivind Olseneiv...@aminor.no wrote: However, another site that _does_ work (with both nameservers on this host, not just ns1) shows the same thing: # nslookup ns1.sharingserver.eu 178.63.65.136 Server:

Re: Unable to query the nameserver

2010-10-06 Thread Kevin Darcy
On 10/6/2010 11:44 AM, Ben McGinnes wrote: On 7/10/10 2:09 AM, Kevin Oberman wrote: I can find nothing in the documentation that states such. If I missed it, I'd appreciate someone pointing me at it. I have some vague memory of seeing messages to that effect when using it on a

Re: Bind and blacklist IP file

2010-10-11 Thread Kevin Darcy
On 10/11/2010 2:44 PM, Nuno Paquete wrote: Ok, but you can always browse by IP address and in this case there is no DNS server than can stop you from browsing what you want. If you want to block IP address access you have to use firewall, or if you are talking about http traffic and have a

Re: How to get easily (from a script) all CNAME of a A record?

2010-11-09 Thread Kevin Darcy
PTR RRs benefit from label compression, whereas TXT records do not. Therefore I prefer PTR records for any such metadata references within DNS. There's no chance they'll be mistaken for, or conflict with reverse DNS records if they're not in the in-addr.arpa branch of the namespace.

Re: BIND View Option

2010-11-10 Thread Kevin Darcy
On 11/10/2010 3:17 PM, J. Thomsen wrote: Is there a way or option to configure bind to do the following logic: If the bind didn’t find a entry in a view 1 (internal view) it will search this entry on the view 2 (external view) ? Not to my knowledge. We had the same problem and ended up with

Re: forward after option

2010-11-10 Thread Kevin Darcy
What you're suggesting is not really the inverse of forward first. Forward first is basically: (try forwarding) - [TIMEOUT FROM ALL FORWARDERS] - (try iterative resolution) The inverse would be: (try iterative resolution) - [TIMEOUT FROM ALL AUTHORITATIVE NAMESERVERS] - (try forwarding) But

Re: why one shouldn't use relative hostnames

2010-11-10 Thread Kevin Darcy
On 11/10/2010 1:19 PM, Maria Iano wrote: We are working with a software vendor whose software only works with relative hostnames - they say it can't cope with a fully-qualified domain name. They want us to make sure the necessary domain is in all clients' search lists. Does anyone have any

Re: no. of Views and Zones

2010-11-10 Thread Kevin Darcy
Alans, I think you're mixing up the resolver function with the hosting function. With some development and implementation, you can offer your customers the ability to set up and maintain their own domains on one nameserver instance, and then have another instance set up for them

Re: BIND View Option

2010-11-10 Thread Kevin Darcy
On 11/10/2010 7:23 PM, J. Thomsen wrote: Not sure why you felt it necessary to resort to hosts files. Well, I don't know how to configure ressource records in an include file and don't want to waste gigabytes of RAM duplicating zones. If your main concern is resource consumption, maybe you

Re: BIND View Option

2010-11-11 Thread Kevin Darcy
On 11/11/2010 7:55 AM, J. Thomsen wrote: If your main concern is resource consumption, maybe you should focus on developing some clever algorithm by which named could keep track of multiple references to the same data, without actually having to make separate copies of the data. Kind of a

Re: BIND View Option

2010-11-11 Thread Kevin Darcy
On 11/11/2010 1:22 PM, J. Thomsen wrote: From a nameserver implementation and maintenance perspective, it's even simpler for the data to already be present in the first view that matches. Why complicate things more than that? Because there is a need for it especially in large installations

Re: Best Practices Query Logging, On or Off ?

2010-11-18 Thread Kevin Darcy
On 11/18/2010 4:10 PM, Russell Jackson wrote: On 11/18/2010 12:19 PM, Kevin Darcy wrote: On 11/18/2010 1:36 PM, CT wrote: I am looking for a best practices for dns query logging Versions in use on Linux... - BIND 9.7.1-P2 - BIND 9.3.6-P1-RedHat-9.3.6-4.P1.el5_4.2 The minimum logging

Re: catchall, if domain doesn't exist?

2010-11-22 Thread Kevin Darcy
On 11/21/2010 3:57 PM, Tomasz Chmielewski wrote: I was wondering if it's possible to return a catchall A record for domains which bind can't resolve? I'm able to configure a catchall bind configuration where bind would return the same A record for all queries; but I'd rather it returns it

Re: Dynamic DNS with secondary nameserver?

2010-12-02 Thread Kevin Darcy
You should have been able to use nsupdate or some other DDNS client tool to add that NS record less disruptively than you did. Understand that rndc freeze doesn't cause updates received in the interim to be queued in some private area and applied later -- it causes them to be *refused* and

Re: Silently drop queries for AAAA records

2010-12-13 Thread Kevin Darcy
On 12/7/2010 5:31 PM, David A. Evans wrote: I'm in the mood to prove a point. I have a very poorly written application that is generating a few hundred queries per second of completely bogus records before attempting a lookup of the correct A records. This is because the

Re: Best practize to store the ZONE files

2011-01-03 Thread Kevin Darcy
It's really more of an OS tuning question, isn't it? The usage pattern of a BIND instance is: a) not much writing of master zone files or journal files unless Dynamic Update is enabled and the frequency of updates is relatively high, b) not much writing of slave/stub zone files or journal

Re: only the response has aa flag can be cached?

2011-01-11 Thread Kevin Darcy
The answers will be cached regardless of the setting of the AA flag. I would suspect that most -- or at least a large percentage -- of DNS queries made by endpoint clients are to upstream resolvers which don't happen to be authoritative for the zone(s) in question, so AA=0 is very common in

Re: NS Cache

2011-01-26 Thread Kevin Darcy
On 1/25/2011 9:40 PM, p...@mail.nsbeta.info wrote: I'm reading the document Secure DNS Deployment Guide got from the URL a poster gave in the list. The document said: When a user types the URL www.example.com into a Web browser, the browser program contacts a type of resolver called a stub

Re: dns best practices

2011-01-26 Thread Kevin Darcy
The document is a little sloppy. In addition to the mis-description of the DNS resolver algorithm, already noted in a previous post, the part in Section 8.1.2 about restricting zone transfers -- These restrictions address [...] potential exploits from unrestricted dissemination of information

Re: Recursive DNS problem

2011-01-31 Thread Kevin Darcy
On 1/28/2011 5:11 AM, Torinthiel wrote: Dnia 2011-01-28 10:52 bangla desh napisał(a): I believed so that com.bd is broken. It only has 1 ns server and hsbc.com.bd, whois.com.bd and even google.com.bd they are all delegate directly from bd and not from com.bd. I am wondering, is there a dns

Re: what's a valid domain name?

2011-01-31 Thread Kevin Darcy
Vyto, Dotted hostnames is a term coined by certain limited DNS-management tools that strive to split up fully-qualified DNS names into a hostname part and a zone (sometimes referred to as domain) part. If one chooses to extend a given name for 2 or more labels below the

Re: dotted hostname is bad IMO

2011-02-02 Thread Kevin Darcy
So, let me see if I have this correctly: you think that DNS architects and/or planners should constrain their choices with respect to namespace layout and/or delegation hierarchy, because of some minor performance considerations, based on your _speculations_ (without any hard evidence) about

Re: about the file command

2011-02-09 Thread Kevin Darcy
On 2/8/2011 9:15 AM, Terry. wrote: 2011/2/8 Matus UHLAR - fantomasuh...@fantomas.sk: On 08.02.11 17:40, Terry. wrote: Can BIND's file command referer to more than one zone file? For example, zone test.nsbeta.info { type master; file a.db; file b.db;

Re: How to allow set Host file dns query priorities in BIND

2011-02-23 Thread Kevin Darcy
On 2/23/2011 4:08 AM, babu dheen wrote: Hi, Our setup is; We have internal DNS server wherein BIND is configured in RHEL 5 and many internal zones are configured. if Internet connection is down, our Internal DNS severs are not able to get the DNS query from ISP DNS server. Because of this,

Re: How to allow set Host file dns query priorities in BIND

2011-02-23 Thread Kevin Darcy
On 2/23/2011 4:57 AM, Eivind Olsen wrote: is there any option in BIND to give priority to HOST file before connecting it to internet ISP or local zone? No. BIND doesn't read/use the hosts file. What you _can_ do is configure BIND to believe it's authoritative for those zones, but I'd not

Re: Help on recursive set up

2011-02-23 Thread Kevin Darcy
There are multiple ways to interpret that question. Normally, a resolver either uses recursion (with a preconfigured set of forwarders) at a given point in resolving a particular name, or it follows the NS records in a delegation chain, non-recursively, in order to find the answer. It

Re: Help with unresolvable domain (subdomain, actually)

2011-03-01 Thread Kevin Darcy
I got a trouble ticket on this too. From the looks of things, Cisco is using GSSes to load-balance this site. GSSes return SERVFAIL if all of the resources behind the load-balancer are down (which it determines via a heartbeat mechanism). So I think this is a simple case of a website (or

Re: Help with unresolvable domain (subdomain, actually)

2011-03-01 Thread Kevin Darcy
See my other post. This is designed-in behavior for Cisco GSSes, since there is no service unavailable, try again later RCODE.

Re: Help with unresolvable domain (subdomain, actually)

2011-03-02 Thread Kevin Darcy
On 3/2/2011 10:34 AM, David Sparro wrote: On 3/1/2011 5:27 PM, Kevin Darcy wrote: See my other post. This is designed-in behavior for Cisco GSSes, since there is no service unavailable, try again later RCODE. When the question is what is the ip address of 'foo' an answer of the web server

Re: Help with unresolvable domain (subdomain, actually)

2011-03-02 Thread Kevin Darcy
On 3/1/2011 6:30 PM, Mark Andrews wrote: In message4d6d7268.1080...@chrysler.com, Kevin Darcy writes: I got a trouble ticket on this too. From the looks of things, Cisco is using GSSes to load-balance this site. GSSes return SERVFAIL if all of the resources behind the load-balancer are down

Re: different behavior: A Records in DNS answer, when query of type any (existing CNAME)

2011-03-07 Thread Kevin Darcy
On 3/7/2011 6:36 AM, Diezig Adrian wrote: Hi, I have a question concerning answers from DNS servers, when I query a name with type any and the name is a CNAME. I have the following example (works also in Internet) with an ISC BIND server (BIND 9.7.0-P1): ; DiG

Re: Root Hints Data File for a .local Domain

2011-03-09 Thread Kevin Darcy
On 3/9/2011 8:32 AM, Tony MacDoodle wrote: Hello, I am currently running BIND 9.6.1-P3 and it works fine. My question is regarding the db.cache file. I am only running a local domain (apps.local) that does not access the internet for resolution. My current root hints file is from Internic.

Re: dots in hostnames problem

2011-03-09 Thread Kevin Darcy
On 3/9/2011 1:09 PM, Matt Rae wrote: Hi, I'm working on setting up a slave dns server. Dots have historically been used in the hostnames here. What does the term hostname mean to you? If hostname is defined as the contents of the first label of a dot-delimited DNS name, then dot in hostname

Re: priority with A record?

2011-04-05 Thread Kevin Darcy
On 4/5/2011 8:23 AM, iharrathi@orange-ftgroup.com wrote: Hi, can i make priority on a A or NS record? Since with round robin if i put the same record record 2 or 3 time, Bind ignore the duplicates Records, means this: wikipediaNSns2.wikimedia.org. wikipediaNSns0.wikimedia.org. is the

Re: BIND 9.4.3-P2 doesn't delegate zone!

2011-04-05 Thread Kevin Darcy
A. Stop using nslookup. It's a really horrible DNS troubleshooting tool. Learn to use dig. B. Do a zone transfer (via dig) of the united-networks.ru zone from the primary master, to verify that the correct delegation record, and associated glue, are contained within named's in-core database of

Re: Zone File IP address/Hostname

2011-04-05 Thread Kevin Darcy
Mistake #1: looking up something using a shortname. Apparently rac2.local is not in your stub resolver's local search list. Always use fully-qualified domain names (FQDNs) for client lookups, and educate your users to do so also. Using FQDNs is the most efficient, least ambiguous, and

Re: priority with A record?

2011-04-11 Thread Kevin Darcy
On 4/8/2011 2:42 PM, John Wobus wrote: All the previously-mentioned issues apply, but (obviously) round robin could be made to offer a select server twice as often by giving that server an additional address and A record. Something similar for nameservers could be devised. Mostly unnecessary

Re: BIND9 fails resolving after connecting to VPN

2011-04-11 Thread Kevin Darcy
On 4/11/2011 7:18 AM, kapetr wrote: Hello, interesting ... - PŮVODNÍ ZPRÁVA - Od: Stacey Marshallstacey.marsh...@gmail.com Komu: kapetrkap...@mizera.cz Předmět: Re: BIND9 fails resolving after connecting to VPN Datum: 9.4.2011 - 22:50:44 I' wondering if the network your attaching to

Re: programmatically determining whether any zones frozen?

2011-04-11 Thread Kevin Darcy
On 4/8/2011 10:56 AM, jeffreyp wrote: greetings, is there a way to programmatically determine if there are any zones frozen? if so, any way to determine the specific zone(s)? what i'm wanting to do is write a monitoring script to sound an alert if there are any zones that have been frozen for

Re: BIND9 fails resolving after connecting to VPN

2011-04-12 Thread Kevin Darcy
On 4/12/2011 4:33 AM, kapetr wrote: Hello, Kevin Darcyk...@chrysler.com WROTE: Do You thing, that this VPN provider - blocks direct (not recursive) DNS questions and - manipulates recursive queries ? [catch them, make query itself and answers with manipulated server IP] ??? None of your

Re: multiple IP address in Address Record in BIND

2011-04-18 Thread Kevin Darcy
On 4/17/2011 2:49 PM, Ben Croswell wrote: In the bind 8 days people would put the same address multiple times and then other addresses as well to weight the responses. -Ben Croswell On Apr 17, 2011 2:45 PM, Eivind Olsen eiv...@aminor.no mailto:eiv...@aminor.no wrote: Hi, we have

Re: Forwarding a subzone of a master zone

2011-04-20 Thread Kevin Darcy
I'd like to reinforce what Chris said, and recommend the use of an internal root zone for networks/enterprises which have no public Internet connectivity, or whose connectivity to the Internet is exclusively through application-level proxies. Don't make Internet names resolvable on your

Re: Dynamic update to the wrong DNS zone file - Bind View - dhcp-client-identifier - multiple network cards with multiple differents subnets

2011-04-21 Thread Kevin Darcy
On 4/21/2011 10:17 AM, Flex Banana wrote: hello list, I use dhcpd-4.2.1 with bind-9.7.3 on a SuSE system. I have 3 network cards with under 700 differents subnets declared in the dhcpd.conf. eth0 = 10.1.1.50 eth1 = 172.16.1.50 eth2 = 192.168.1.50 We use Dynamic DNS

Re: does authority named require the external name servers?

2011-05-03 Thread Kevin Darcy
On 5/2/2011 9:50 PM, Jeff Pang wrote: 2011/5/3 Jeff Pangjeffrp...@gmail.com: 2011/5/3 Chris Thompsonc...@cam.ac.uk: It will need to know the addresses of ns1.def.com ns2.def.com to send them NOTIFY packets when the zone is updated (unless that has been suppressed). But it gets those by (if

Re: forward first: iterative or recursive query

2011-05-06 Thread Kevin Darcy
On 5/6/2011 6:40 AM, iharrathi@orange-ftgroup.com wrote: Thanks for the answer but: * In the example i post yesterday: on my server1 the recursion is enabled (recursion yes), but the server1 can't recurse because i stop it on firewall and it can't contact the outside.

Re: Primary Server Name Change

2011-05-12 Thread Kevin Darcy
On 5/12/2011 3:21 PM, Michelle Konzack wrote: Hello CT, Am 2011-05-12 13:09:35, hacktest Du folgendes herunter: Primary Name server bind- 9.7.3 OS- CentOS 5.6 Authoritative for 2 zones using DNSSEC This may be an obvious question but I will ask anyway.. :) I want to change the name

Re: norecursion on external zone, but how do I allow CNAMEs to be fully resolved?

2011-05-20 Thread Kevin Darcy
This is why people run separate views, separate instances, or separate devices for DNS resolution (= recursive, by necessity) versus DNS hosting (= non-recursive, best practice). If you run both hosting and resolution on the same nameserver instance but different views, you may need to be a

Re: Deny MX query

2011-05-25 Thread Kevin Darcy
On 5/25/2011 9:21 AM, Niobos wrote: On 2011-05-24 21:58, Warren Kumari wrote: On May 24, 2011, at 1:55 PM, Igor da Silva Cagnin wrote: I have a doubt about querys, as fact I’d like to deny just querys type MX. Other querys types must be available. Is it possible? Yes. 1: Don't list the MX

Re: recursive server querying authoritative - timeout before trying next server?

2011-05-26 Thread Kevin Darcy
On 5/26/2011 2:51 PM, Dan Pritts wrote: Hi, A question regarding BIND defaults. I'd love the same answer for other nameserver software if anyone cares to share. I am a recursive nameserver. I am looking for foo.bar.com. i've learned from bar.com that foo.bar.com has four NS records. I've

Re: DNS Racing -Multi ISP load balancing with failover using DNS.

2011-05-30 Thread Kevin Darcy
even get me started on car commercials. I've seen a few that never even made it to the public eye :-) On 5/30/2011 8:18 PM, Mark Andrews wrote: In message4de42bef.3050...@chrysler.com, Kevin Darcy writes: Get back to us when you prove that this co-exists with DNSSEC; otherwise it's a non-starter

Re: Compromised BIND?

2011-05-31 Thread Kevin Darcy
On 5/31/2011 2:38 PM, Supersonic wrote: I have a BIND 9.8.0-P2 server instance running on a production server. Doing what, exactly? Resolving internal names only? Resolving Internet names? Acting as an authoritative server for internal clients? Internet clients? Some combination of the

Re: link-local glue AAAA

2011-06-05 Thread Kevin Darcy
On 6/5/2011 9:07 AM, Peter Andreev wrote: Hi I'm puzzled a little - i see in my zone glue records with link-local addresses. I think it is not good, but no rfc mentions about link-local in glue. Could someone tell me best practices for link-local in glue? Well, some things are so obvious

Re: DNS Trouble

2011-06-15 Thread Kevin Darcy
On 6/12/2011 4:00 PM, Rodrigo Faria Tavares wrote: Hello, I installed bind in CentOS release 5.6 (Final). My DNS Server not ping alias (with cname), so the steps: I installed this packages: [root@centos ~]# rpm -qa | grep bind ypbind-1.19-12.el5 bind-libs-9.3.6-16.P1.el5

Re: bind 9 performance

2011-06-15 Thread Kevin Darcy
On 6/15/2011 4:06 PM, abushla...@ies.etisalat.ae wrote: What about zone configuration in BIND 8 and BIND 9? Is there any difference between the two ? Thanks Regards -Original Message- From: Eivind Olseneiv...@aminor.no Sender:

Re: question about thehartford.com domain

2011-06-16 Thread Kevin Darcy
On 6/15/2011 7:41 PM, M. Meadows wrote: The DNS admins at thehartford.com seem to feel that this nameserver mismatch is working as expected. Here's some of the feedback we received from them when we questioned the setup: ~ We use load balancers for the majority of our

Re: Doubt

2011-06-20 Thread Kevin Darcy
On 6/20/2011 7:04 AM, Vignesh Gadiyar wrote: What do the client.c and server.c programs in the /bin/named do? They're not programs, they're C source files in the BIND distribution: % ls bin/named/client.c bin/named/server.c bin/named/client.c bin/named/server.c % As part of the build

Re: Views and no answers ...

2011-06-20 Thread Kevin Darcy
On 6/18/2011 12:08 AM, Thomas Schweikle wrote: Hi! I have set up a view for one site. It is bound to change answers as necessary for different IP-ranges. It works as far as I could see. But with one ip-range there is a problem ... I can query internal addresses: !user@kvm2~# host

Re: I can't resolve one domain: nhs.uk

2011-06-20 Thread Kevin Darcy
On 6/17/2011 8:01 AM, Phil Mayers wrote: On 17/06/11 12:10, Andrew Benton wrote: And it works well for every domain on the internet. Except for www.nhs.uk - I can't resolve nhs.uk www.nhs.uk is, currently, a CNAME to www.prod.nhs.uk.akadns.net You might be suffering from the bind 9.8 CNAME

Re: servfail when refresh aws.amazon.com

2011-06-22 Thread Kevin Darcy
On 6/22/2011 7:26 AM, Eric Yiu wrote: Hi, I am using bind9.7.3-P1 with solaris10x86. I notice that sometimes our bind server will reply servfail when querying a zone aws.amazon.com http://aws.amazon.com which is expiring, while this aws.amazon.com http://aws.amazon.com only 60sec cache

Re: Logging Response Results

2011-06-23 Thread Kevin Darcy
On 6/23/2011 4:27 PM, Stefan Certic wrote: Thanks Chuck Yes, that would be a solution, but i need logs processed through syslog and stored into database (matching the initial query from query log). Pharsing tcpdump is not going to be suitable for highly loaded system. I was more looking for a

Re: Client cannot resolve communities.intel.com

2011-07-05 Thread Kevin Darcy
On 7/5/2011 12:28 AM, Fajar A. Nugraha wrote: On Tue, Jul 5, 2011 at 10:29 AM, vrbind-u...@iotk.net wrote: Hello, I am trying to visit http://communities.intel.com; using Iceweasel on a Debian desktop PC. No proxies. My clients etc/resolv.conf point to my own Debian BIND 9.7.3 installed on a

Re: Doubt with towiresorted

2011-07-06 Thread Kevin Darcy
was normally Cyclic. The result was that only the answer section records were getting sorted in the random order and all other records were cyclic. Is this the behavior if we set order to any order we want. -Vignesh. On Mon, Jul 4, 2011 at 9:38 PM, Kevin Darcy k...@chrysler.com mailto:k

Re: about AUTHORITY SECTION

2011-07-07 Thread Kevin Darcy
On 7/7/2011 1:50 AM, Torinthiel wrote: On 07/07/11 04:56, pa...@laposte.net wrote: Hello, I got two different forms of AUTHORITY SECTION from the dig, for example, $ dig mydots.net @ns7.dnsbed.com ; DiG 9.4.2-P2.1 mydots.net @ns7.dnsbed.com ;; global options: printcmd ;; Got answer: ;;

Re: about AUTHORITY SECTION

2011-07-08 Thread Kevin Darcy
On 7/8/2011 3:04 AM, Chris Buxton wrote: On Jul 7, 2011, at 6:32 PM, Feng He wrote: 2011/7/8 Kevin Darcyk...@chrysler.com: I think it's worth emphasizing that in the first case, the contents of the Authority Section were *mandatory* (see RFC 2308, Negative Caching), whereas in the second case

Re: Allowing resolution of off-server CNAMEs

2011-07-11 Thread Kevin Darcy
On 7/8/2011 12:11 PM, Joseph S D Yao wrote: It should be possible to set up an authoritative-only name server so that it does not recurse for anyone [except perhaps itself], but still allow someone to get a full resolution of a name whose canonical name is elsewhere. IMHBUCO. I started with

Re: Clients get DNS timeouts because ipv6 means more queries for each lookup

2011-07-11 Thread Kevin Darcy
On 7/11/2011 2:11 PM, Jonathan Kamens wrote: The number of DNS queries required for each address lookup requested by a client has gone up considerably because of IPV6. The problem is being exacerbated by the fact that many DNS servers on the net don't yet support IPV6 queries. The result is

Re: Clients get DNS timeouts because ipv6 means more queries for each lookup

2011-07-13 Thread Kevin Darcy
On 7/13/2011 2:35 AM, Jonathan Kamens wrote: On 07/13/2011 02:13 AM, Mark Andrews wrote: Well, all the prodding from people here prompted me to investigate further exactly what's going on. The problem isn't what I thought it was. It appears to be a bug in glibc, and I've filed a bug report and

Re: Clients get DNS timeouts because ipv6 means more queries for each lookup

2011-07-13 Thread Kevin Darcy
On 7/13/2011 1:06 PM, Kevin Darcy wrote: On 7/13/2011 2:35 AM, Jonathan Kamens wrote: On 07/13/2011 02:13 AM, Mark Andrews wrote: Well, all the prodding from people here prompted me to investigate further exactly what's going on. The problem isn't what I thought it was. It appears to be a bug

Re: Clients get DNS timeouts because ipv6 means more queries for each lookup

2011-07-13 Thread Kevin Darcy
On 7/13/2011 2:39 PM, Jonathan Kamens wrote: I agree that the order of the A/ responses shouldn't matter to the result. The whole getaddrinfo() call should fail regardless of whether the failure is seen first or the valid response is seen first. Why? Because getaddrinfo() should, if it

Re: sort list and view

2011-07-19 Thread Kevin Darcy
On 7/18/2011 11:42 PM, AMANI MOHAMED BIN SUWAIF wrote: Hi, I have the below scenario _TCP.EXAMPLE.COMIN SRV1005060primary-sbg.example.com _TCP.EXAMPLE.COMIN SRV2005060 secondary-sbg.example.com I have 2 IP ranges and 2 SBGs host, my intention is for

Re: sort list and view

2011-07-20 Thread Kevin Darcy
records. Thanks Regards, *Amani* On 7/20/2011 2:50 AM, Kevin Darcy wrote: On 7/18/2011 11:42 PM, AMANI MOHAMED BIN SUWAIF wrote: Hi, I have the below scenario _TCP.EXAMPLE.COMIN SRV1005060 primary-sbg.example.com _TCP.EXAMPLE.COMIN SRV2005060

Re: Forward only zones.

2011-07-25 Thread Kevin Darcy
On 7/24/2011 2:15 AM, Vbvbrj wrote: options { allow-transfer { none; }; recursion yes; forward first; forwarders { a.b.c.d; }; // Forward to providers dns. }; zone my_domain.com IN { type forward; forward only; forwarders { a.b.c.d; }; // Forward to Windows DNS. }; I would like

Re: howto know if a query was delegated to cache

2011-07-25 Thread Kevin Darcy
On 7/25/2011 6:14 AM, harish badrinath wrote: (Originally sent to bind-workers, sorry if this is considered cross posting. Slightly modified from the original message) Hello, I am using Bind version:BIND 9.7.1-P2 I am doing some small internal changes to bind and i have to know when a query

Re: DNS Caching Issue

2011-07-26 Thread Kevin Darcy
On 7/25/2011 10:22 AM, Sathyan Arjunan (sarjunan) [CONTRACTOR] wrote: Recent days, I am facing frequent caching issues with my DNS servers which are responsible for recursive lookup to external queries. As a temporary solution, we used to refresh the named daemon to clear the cache. To

Re: Split PTR zone (internal and external)

2011-07-28 Thread Kevin Darcy
On 7/28/2011 12:26 PM, CT wrote: I am wondering what might be a good workaround for this legacy setup... Will do my best to explain.. IP Space - 1 Class B Global Unique (used Externally and Internally) - 1 Class B RFC1918 DNS Setup External DNS (Linux - Bind 9.8.x) - example-ext.com

Re: [UNsolved] was: what does dig +trace do?

2011-09-06 Thread Kevin Darcy
On 9/1/2011 7:57 PM, Mark Andrews wrote: In message4e5fb1ab.4040...@data.pl, Torinthiel writes: On 09/01/11 17:56, Tom Schmitt wrote: =20 I found the cause of my problem (and a solution): =20 dig +trace actually has another behaviour than doing the trace manually= step by step with dig.

Re: DiG unexpected source with a Subnet-Router anycast address

2011-09-07 Thread Kevin Darcy
Why are you trying to use the SRAA for DNS resolution? SRAA has a special meaning to network-infrastructure devices; I don't think it was ever intended for anycasting general network services. Just pick one of your global-unicast address, and anycast that instead. There was an old

Re: [UNsolved] was: what does dig +trace do?

2011-09-07 Thread Kevin Darcy
On 9/6/2011 8:40 PM, Mark Andrews wrote: In message4e66b5b5.30...@chrysler.com, Kevin Darcy writes: On 9/1/2011 7:57 PM, Mark Andrews wrote: In message4e5fb1ab.4040...@data.pl, Torinthiel writes: On 09/01/11 17:56, Tom Schmitt wrote: =20 I found the cause of my problem (and a solution): =20

Re: Proper CNAME interpretation

2011-09-14 Thread Kevin Darcy
On 9/14/2011 5:52 PM, Chuck Swiger wrote: On Sep 14, 2011, at 2:27 PM, Ronald F. Guilmette wrote: The second part however seems to go more to my question, which is What is the resolver supposed to do when some knucklehead breaks the rules and puts a CNAME in with some other stuff? Depends on

Re: Query regarding NS record

2011-09-18 Thread Kevin Darcy
Are you talking about recursive clients failing over? Or other nameservers trying to talk to yours, non-recursively? Recursive clients don't use NS records at all and you need to approach the failover problem in a completely different way (e.g. relying on the client failing over from one

Re: Correct SRV configuration

2011-09-18 Thread Kevin Darcy
The name goyello.com *itself* owns no SRV records. You never added any with that name. host doesn't have any special knowledge of SRV records, and, besides, you didn't tell it what service and protocol, so it didn't even have enough information to construct the appropriate name to look up.

Re: Query regarding NS record

2011-09-18 Thread Kevin Darcy
) to my DNS server in firewall or i just need to allow DNS traffic only from ISP DNS server ISP DNS server configuration mycompany-dns-server-ip INA 10.10.10.10 mail.myoffice.com INNSmycompany dns server ip Regards Papdheen M *From:* Kevin Darcy k...@chrysler.com *To:* bind-users

Re: Max Cache Objects

2011-09-21 Thread Kevin Darcy
On 9/21/2011 5:00 PM, TMK wrote: I have couple of questions. bind cache memory limit is 4GB. can I increase it. or this is hard-coded limit. i'm running the x64 bit version. You can _try_ to raise that limit above 4Gb (see the various configuration elements under Operating System Resource

Re: DNS-cache with custom gTLDs

2011-09-21 Thread Kevin Darcy
On 9/20/2011 5:08 AM, Drunkard Zhang wrote: I got 4 DNSs doing recursive resolution, which splited into 2 groups, and a couple of dns caches. Each group of recursion DNS using their own net link, which is different. Here's problem: I want a dns-cache to use one group of recursion DNS as their

Re: DNS-cache with custom gTLDs

2011-09-22 Thread Kevin Darcy
On 9/21/2011 10:01 PM, Drunkard Zhang wrote: Why are you going through all of these gyrations? The forwarding algorithm in BIND has for a long time been based on RTT, so if one forwarder, or a set of forwarders, stops working, the other(s) will be used automatically. In other words, forwarder

Re: DNS-cache with custom gTLDs

2011-09-22 Thread Kevin Darcy
On 9/22/2011 6:03 AM, Drunkard Zhang wrote: Oops, I misunderstood. But I want to resolve this problem: take news.qq.com for example, I DID saw that it's unresolvable to one group (they returned NXDomain), at meantime it's no problem to another group, and dig news.qq.com +trace returned correct

Re: Bind takes a long time to resolve requests

2011-10-04 Thread Kevin Darcy
On 10/4/2011 12:40 PM, Pablo Maurelli wrote: hello, pick up a dns server with bind9, is resolving claims, but it takes time to resolve a lot, sometimes throw timeout error and the second time resolved, any ideas? I pass below my named.conf, host.conf and nsswitch.conf

Re: changing ttl of mx record

2011-10-10 Thread Kevin Darcy
On 10/10/2011 11:13 AM, enigmedia wrote: On 10/10/2011 9:26 AM, Albert E. Whale, CHS CISA CISSP wrote: If you are going to update the IP and TTL, why not adjust both? This will take care of some broken DNS packages. Hth Thanks, I had googled around a bit and saw some conflicting opinions

Re: Master and slave on same host

2011-10-11 Thread Kevin Darcy
On 10/11/2011 1:45 PM, Joseph L. Casale wrote: What do you mean you can’t have additional IPs? Even if you don’t have other network connections you can use virtual IPs on a single NIC. I have one server (not DNS) that has 30 virtual IPs on a single NIC. Well, there is other software I was

Re: Master and slave on same host

2011-10-11 Thread Kevin Darcy
On 10/11/2011 4:05 PM, Joseph L. Casale wrote: If one view or the other communicates exclusively with other devices on the same link, you could probably get away with using an IPv6 link-local address, which is likely already present on your system (if you're running a modern OS), and is probably

Re: host versus nslookup

2011-10-12 Thread Kevin Darcy
On 10/12/2011 1:21 PM, Martin McCormick wrote: Many years ago, various flavors of unix began distributing a utility called host which did almost the same thing as nslookup. Host is what I use most of the time, now, and I actually thought that nslookup on unix systems was maybe going away.

Re: host versus nslookup

2011-10-12 Thread Kevin Darcy
On 10/12/2011 5:46 PM, Sten Carlsen wrote: On 12/10/11 22:33, Fajar A. Nugraha wrote: On Thu, Oct 13, 2011 at 3:23 AM, Sten Carlsenst...@s-carlsen.dk wrote: Use dig. Always use dig. I don't quite agree, for debugging bind, use dig - for debugging lookup issues on some machine, host will

Re: zone before delegation?

2011-10-28 Thread Kevin Darcy
On 10/28/2011 12:48 PM, Laws, Peter C. wrote: It seems like there are two ways I could delegate a zone. I could, in the zone file for the parent, simply list the name of the zone and a number of NS records to which the zone has been delegated. Or, I could create a zone statement within

Re: what's a valid domain name?

2011-10-31 Thread Kevin Darcy
On 10/31/2011 6:58 AM, Kristen Eisenberg wrote: Ben Croswell writes: In that case technically you are creating undelegated subdomains for each router. The dot is a delimiter and can't be part of a hostname. I was thinking you are wrong. Period is somewhat permitted in a hostname.

Re: Subdomain Issue

2011-11-08 Thread Kevin Darcy
On 11/8/2011 4:39 PM, Matus UHLAR - fantomas wrote: On 08.11.11 20:27, trm asn wrote: I have one domain example.com [...] *testINNSns1973.hostgator.com. testINNSns1974.hostgator.com.* [...] what are these supposed to mean? After commenting out below entries rndc

Re: Reason for Limited number of Root DNS Servers

2011-11-11 Thread Kevin Darcy
On 11/11/2011 4:30 AM, Gaurav Kansal wrote: Thanks a lot Mark. But I don't understand the calculation part. Is there any source available from which I can get detail information regarding the same?? Thanks and Regards, Gaurav Kansal 9910118448 -Original Message- From: Mark

<    1   2   3   4   5   >