Re: consolidating in-addr.arpa data

Hi there, On Sat, 16 Sep 2023, Greg Choules wrote: On Sat, 16 Sep 2023, G.W. Haywood wrote: ... > Is there a reason not to split the /8 into two /9s or something like that? ... Although it is technically possible to do reverses on non-octet boundaries (for example, see

Re: consolidating in-addr.arpa data

Hi there, On Sat, 16 Sep 2023, John Thurston wrote: A host which auto-registers in MS DNS, creates an A in foo.alaska.gov and PTR in whatever.10.in-addr.arpa. MS DNS is happy to publish those. But the DNS system running on BIND also has a whatever.10.in-addr.arpa zone. So if I want to

Re: General DNS / SPF question

Hi there, On Mon, 9 Jan 2023, Michael Muller wrote: Thanks for responding to my question. Again, if there's a better place to ask this question, I can go there. ... Taking this off list. -- 73, Ged. -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list

Re: General DNS / SPF question

Hi there, On Sun, 8 Jan 2023, Mark Andrews wrote: Please don't hijack an existing thread by replying to an existing message for a unrelated subject. It is bad form. Just create a new message and send it to bind-us...@isc.org. Oh, blast, I missed that, sorry. -- 73, Ged. -- Visit

Re: General DNS / SPF question

Hi there, On Sat, 7 Jan 2023, Michael Muller wrote: This is my first time posting here, and I'm not sure if it's the right place or not to ask my question. This is a general DNS question, specifically, I think, SPF. Probably not really the right place but the SPF users' list has been a bit

Re: RFC7344 (was: Funky Key Tag in AWS Route53 (2)) (2)

Hi there, On Fri, 30 Dec 2022, Timothe Litt wrote: The problem is politics, not technology. Well there might be a little more to it than that. People just don't know. When my wife asked about the security of her bank's Website they told her, "Don't worry, if there's a little padlock in

Re: Bind 9.16.1 crash

Hi there, On Thu, 8 Dec 2022, Ondřej Surý wrote: The "we don't update upstream version" policy works well only if you carefully pick upstream version. Instead this is snapshot of Debian at random point ... Somewhat OT, but this applies to more or less all software which you might think of as

Re: Add TXT records for SPF when CNAME exists in same sub-domain

Hi there, On Tue, 29 Nov 2022, Mark Andrews wrote: Chris Liesfield wrote: > It appears TXT and CNAME records for the same string/host cannot > co-exist. We are able to specify an SPF record for the origin only > in each sub-domain. > > Open to any suggestions on how to get around this

Re: Mailing list questions (DMARC, ARC, more?)

Hi there, On Tue, 23 Aug 2022, Alessandro Vesely wrote: I see the list operates both From: munging and ARC sealing. While I'm clear about the former, I'm curious about how ARC works: Do any subscribers trust the seal by isc.org? When it comes to email, I don't trust *anything*. :)

Re: Basic setup instructions

Hi there, On Mon, 25 Jul 2022, Gene Ammerman wrote: I am on a Mac running macOS 10.10 with server 5.7 and I just need to setup DNS for this. Your meaning is not clear to me. When you say "I just need to setup DNS" which of the following do you mean: (a) I need applications which run on

Re: ipv6 adoption

Hi Grant, On Thu, 17 Feb 2022, Grant Taylor wrote: Please clarify if you are talking about DNSSEC for your own zone that they are doing secondary transfers of or if you are talking about DNSSEC for the IPv6's reverse DNS namespace that they delegate to you. Ah, good point Grant. The

Re: ipv6 adoption

Hi there, On Wed, 16 Feb 2022, Mark Tinka wrote: On 2/16/22 17:18, Timothe Litt wrote: > You can get IPv6 via a tunnel broker.? Hurricane Electric > (http://he.net/) is one of the larger ones.? You can get a /48 from > them - for free.? Bandwidth is modest.? You can setup reverse zones; >

Re: your mail

Hi there, On Sat, 15 Jan 2022, Diego Garcia wrote: On Sat, Jan 15, 2022 at 2:14 PM G.W. Haywood via bind-users wrote: > On Sat, 15 Jan 2022, Diego Garcia wrote: > > ... > > network unreachable resolving 'play.google.com/A/IN': 216.239.36.10#53 > > ... > ... If

Re: your mail

Hi there, On Sat, 15 Jan 2022, Diego Garcia wrote: Still with problems. That setup was running fine for few years. But you changed something. Bind Server is on DMZ and doing NAT for the local net. Test Server is behing NAT Must have another problem I try this days a lot of things and

Re: what is wrong with DNS name 'covid19booster.healthservice.ie' ? : Google : what is Google's secret DNS service ?

Hi there, On Sat, 8 Jan 2022, Jason wrote: ... My point is that public service websites, which provide vital public health services , on which people's lives and human rights depend , should NOT be on some "Google Server Accessable Only" Hidden Internet . And they aren't. What about

Re: A good name for development branch releases package

Hi there, On Wed, 1 Dec 2021, Petr Men??k wrote: ... Would you have some idea, how should it be called? Call a spade a spade. Or in this case "bind9-unstable". Do you like "bind9-dev" base name? No. It will cause confusion. -- 73, Ged. ___

Re: BIND 9.16.19 or any version newer than 9.16.15 does not start on Windows Server 2019

Hi there, On Wed, 8 Sep 2021, Sami Leino wrote: I will return to this problem with 8 vCPU count. You wrote earlier that there could be a way to have BIND run a specific number of vCPU cores? Have you tried searching something like "windows processor affinity"? -- 73, Ged.

Re: Logging statements w.r.t. view in Bind 9.16.18

Hi there, On Tue, 24 Aug 2021, Gaurav Kansal wrote: I want a clarity whether we can have individual logging statement per view basis ? Whatever i found on google, i think we can't. My use case for separate logging statement is as follows - In my recursive server, i have 2 views, one for my

Re: [Question] About migration for 9.11.X to 9.16.X.

Hi there, On Thu, 19 Aug 2021, Techs-yama wrote: I'm thinking about BIND Version migration for 9.11.X to 9.16.X. Also, I'm about to check the different default config value and config parameters for the purpose of that now. I would like to ask you all. Are there any other points of observe

Re: Tracking Down Odd bind Behavior

Hi there, On Sun, 15 Aug 2021, Tim Daneliuk wrote: I have a bind slave instance running on FreeBSD 13-STABLE. Periodically (after a few days of perfect operation), it loses its ability to resolve at least some names - in this case, git.freebsd.org. ... ... Aug 14 17:07:03 ozzie named[32292]:

Re: My FC33->FC34 bind-chroot upgrade notes

Hi there, On Wed, 16 Jun 2021, ToddAndMargo wrote: Re: My FC33->FC34 bind-chroot upgrade notes I hope this is the last time I have to revise this! ... Unfortunately perhaps not. ... # means root $ means user ... Sometimes, in your configuration file extracts, you use '#' meaning 'this

Re: Need Help with BIND9

Hi there, On Sat, 12 Jun 2021, techli...@phpcoderusa.com wrote: Re: Need Help with BIND9 ... The two domains I am working with on my SOHO home server are 1) keiththewebguy.com and 2) phpcodetest.com. I setup keiththewebguy.com first and configured BIND9 for it on the same server. To try to

Re: root.hints - apparmor access error with Bind from PPA

Hi there, On Fri, 4 Jun 2021, 3coma3 wrote: Jun 3 22:03:53 ... apparmor="DENIED" ... "/usr/share/dns/root.hints" ... This isn't exactly an answer to your question but I don't think you need root.hints any more - you can just delete it. I'm currently using 9.11.26, and I haven't used

Re: BIND 9.16.17-snapshot - testers needed - recursive performance

Hi there, On Wed, 26 May 2021, He/Him wrote: we merged a change that substantially reduces a contention between threads and improves the recursive performance ... We are currently running 9.11.26, and 9.11 has always built with no issues. Debian 9.13 (Stretch). $ aunpack

Re: BIND 9 ARM, html/pdf not in the source?

Hi there, On Sun, 16 May 2021, Ond?ej Sur? wrote: On Sun, 16 May 2021, Chuck Aurora wrote: > On Sun, 16 May 2021, Ond?ej Sur? wrote: > > > ... yes, you need ISC GitLab account to create new issues (unless > > it's a security vulnerability then OpenPGP encrypted email is > > accepted). We need

Re: Inline signing fails dnsviz test - STILL [LONG]

Hello again, On Sun, 16 May 2021, I wrote: ... If you can't agree their numbers then you're some information ... Having screen troubles. The word 'missing' is missing. -- 73, Ged. ___ Please visit

Re: Inline signing fails dnsviz test - STILL [LONG]

Hi there, On Sun, 16 May 2021, Dan Egli wrote: ... I'm aware of the buddyns.com servers not responding. Noting I can do about that. They CLAIM I've had over 300k requests in the last couple of weeks and have exceeded my monthly cap. I say Bull Crap ... I'd be inclined to believe them, but

Re: BIND through COPR after CentOS

Hi there, On Fri, 18 Dec 2020, Leroy Tennison wrote: ... switching from an rpm world to a deb world ... Not an enormous change but significant. Indeed. I'd suggest that if it's just about BIND, it's easier to grab the source and build it. That way you don't ever have to wait for the

Re: NXDOMAIN problems

Hi there, On Tue, 17 Nov 2020, Boylan, Ross wrote: I have been experiencing NXDOMAIN errors ... ... There are a lot of complications. ... The remote machine is only accessible though VPN ... the nameserver ... is also accessible only through VPN ... The VPN connection has always been a bit

Re: Bind 9.16.x won't start from systemd

Hi there, On Wed, 8 Jul 2020, Adrian van Bloois wrote: When I try to start bind 9.16.x from systemd it fails not being able to find something. When I start it straight from the CMD-line like: sudo /usr/local/sbin/named There is no problem and it works fine. What could be the problem???

Re: Steps to reload zone files automatically?

Hi there, On Wed, 1 Jul 2020, Harshith Mulky wrote: Is there an automatic way we could use reloading the zone files rather than using rndc reload or named restart? It should be trivial to implement this, but I'm not sure that I'd want to do it on a server of mine. We are running bind with

Re: BIND Masters and slaves

Hi there, On Mon, 15 Jun 2020, bind-users-requ...@lists.isc.org wrote - and wrote, and wrote: ... [all sniped] ... Please guys[1], stop it. -- 73, Ged. [1] The masculine embraces the feminine where the context permits. ___ Please visit

Re: Does 'make uninstall' work?

Hi there, On Thu, 28 May 2020, Nyamkhand Buluukhuu wrote: ... Does 'make uninstall' command work? I have a source folder remained. Or do I need to compile a newer version with a different prefix and make a link? Which one is the safest way? If make uninstall doesn't work, how do you guys

Re: Machine friendly alternative to nsupdate

Hi there, On Wed, 1 Apr 2020, Petr Bena wrote: ... Is there any alternative to nsupdate, something that can work with XML or JSON payloads or provide output in such machine parseable format? ... If it's any help DNS::ZoneParse claims to be able to output XML - but I don't have any experience

Re: recursive resolver

Hi there, On Thu, 12 Mar 2020, G.W. Haywood wrote: On Thu, 12 Mar 2020, ShubhamGoyal wrote: How can i improve my recursive resolver speed. I wonder if you have some kind of networking misconfiguration which results in timeouts while BIND is waiting for responses. Perhaps you will learn

Re: recursive resolver

Hi there, On Thu, 12 Mar 2020, ShubhamGoyal wrote: we made a recurive resolver (Cent OS 7, 8GB RAM ,250 GB Hard disk and network speed is also good ) . It reply in 1200 msec and 1800 msec (which is very slow). if it gave Reply by Cache (80 msec or 76 msec). so i want to know about, How can i

Re: Advice on balancing web traffic using geoip ACls

Hi there, On Sun, 23 Feb 2020, Scott A. Wozny wrote: Greetings BIND gurus, Sorry, I can't make any claim to be a BIND guru. ... webserver clusters hosted on the west and east coasts of the US and would like to use Bind 9.11.4 Hmmm. You might want to look e.g. at all the fixes since

Re: Using different OS for Master and Slaves

Hi there, On Tue, 12 Nov 2019, Mundile wrote: Is it good idea and possible to create Master and Slaves nameservers using different OSes. For example , Master OS =Centos 7 and Slaves Os=Ubuntu 18 or Windows 2016 It depends on whether or not you enjoy pain. Sent from Mail for Windows 10

Re: Can i remove @0x in my log query message, bind 9.11

Hi there, On Mon, 4 Nov 2019, Nguyen Huy Bac wrote: ... bind 9.11, have @0x in log query message. But, my statistical system dont support two log message structure at the same. So, my question is: Can and How to remove @0x in my log query message. You could do this for example by piping the

Re: RPZ with Spamhaus

Hi there, On Mon, 24 Jun 2019, Tony Finch wrote: Mik J via bind-users wrote: > > I registered in spamhaus but don't know how to be able to axfr the > content of the zone ... The DROP lists are freely available in plain text so if you are handy with bit of programming it isn't too hard to turn

Re: A policy for removing named.conf options.

Hi there, On Thu, 13 Jun 2019, Leroy Tennison wrote: On Thu, 13 Jun 2019, Ond?ej Sur? wrote: On 13 Jun 2019, at 15:55, G.W. Haywood via bind-users ... wrote: ... could you not set up an ISC zone which BIND on startup will ping ... we?ve been discussing the ?call home? feature on several

Re: A policy for removing named.conf options.

Hello again, On Thu, 13 Jun 2019, Matthijs Mekking wrote: On 6/13/19 2:40 PM, G.W. Haywood via bind-users wrote: > On Thu, 13 Jun 2019, Matthijs Mekking? wrote: > > > | managed-keys?? | 9.15/9.16 | replaced with dnssec-keys | > > According to my changelogs for 'named.conf

Re: A policy for removing named.conf options.

Hi there, On Thu, 13 Jun 2019, Matthijs Mekking wrote: We would like to hear your feedback. Thank you for the timely heads up. | managed-keys | 9.15/9.16 | replaced with dnssec-keys | According to my changelogs for 'named.conf I removed 'managed-keys' and 'trusted-keys' three

Re: allow-update in global options (was Re: bind and certbot with dns-challenge)

Hello again, On Mon, 18 Mar 2019, Alan Clegg wrote: Take the personal attacks elsewhere if you don't mind. My post was not intended to be a personal attack. I did explain that it was sent in more haste than I'd have liked, and perhaps it might have been better if I'd have left it until I

Re: allow-update in global options (was Re: bind and certbot with dns-challenge)

Hi there, I've been reading this exchange with growing frustration, and I hope a forthright response will be excused - especially since I now have to dash out to the hospital so I don't have more time to work on this. On Mon, 18 Mar 2019, or possibly earlier, Alan Clegg wrote: The change was

Re: Classless Reverse Zones PTR Dig Format Issue

Hi there, On Thu, 7 Feb 2019, Matus UHLAR - fantomas wrote: On 07.02.19 12:53, Nagesh Thati wrote: I have created a network with *199.192.0.0/11 * and created 4 subnets with */13* mask in that network, Network: *199.192.0.0/11 :

Re: Question about visibility

Hi there, On Thu, 25 Oct 2018, Grant Taylor wrote: On 10/24/2018 06:15 AM, G.W. Haywood via bind-users wrote: A server on a non-standard port is often neglected.? Its security may be less well maintained than one that is intentionally public. Why and how do you make that correlation

Re: Question about visibility

Hi there, On Wed, 24 Oct 2018, Hardy, Andrew wrote: Further to the original post, as well as not creating a DNS record and "possibly" adding robot.txt with appropriate content, as discussed, I presume that if I run the http server on a personally selected unprivileged port then it is very

Re: DNSSEC: give KSK from my domain to parent zones

Hi there, On Fri, 5 Oct 2018, Roberto Carna wrote: ... when I check for the DNSEC support with: dig com.uk +dnssec +multi I can see there is no support at all...so use DNSSEC for xxx.com.uk has no sense at allhasn't it? Do you mean "xxx.co.uk" and not "xxx.com.uk"? -- 73, Ged.

Re: BIND and UDP tuning

Hello again, On Mon, 1 Oct 2018, Alex wrote: > Are your requests being dropped by the service(s)? > > (Or: are you inadvertently abusing the said service(s)?) I don't believe so - often times a follow-up host query succeeds without issue. It's also failing for invaluement and spamhaus, both

Re: BIND and UDP tuning

Hi there, On Sun, 30 Sep 2018, Alex wrote: Sep 29 14:33:54 mail03 postfix/dnsblog[3290]: warning: dnsblog_query: lookup error for DNS query 123.139.28.66.dnsbl.sorbs.net: Host or domain name not found. Name service error for name=123.139.28.66.dnsbl.sorbs.net type=A: Host not found, try again

Re: BIND and UDP tuning

Hi there, On Thu, 27 Sep 2018, Alex wrote This is also only happening on the two identical systems connected to the 165/35mbit cable modem. ... I really hope there is > someone with some additional ideas. Is it the modem? -- 73, Ged. ___ Please

Re: Operational Notification: Some releases of BIND are too strict when handling referrals containing non-empty answer sections

Hi there, On Wed, 19 Sep 2018, Michael McNally wrote: ... code refactoring ... That phrase always sends shudders through my corpus. -- 73, Ged. ___ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list

Re: Test mail to bind-users

Hi Michael, On Wed, 30 May 2018, Michael McNally wrote: We have had reports that posts to bind-users are (in at least some cases) triggering unwelcome direct-to-the-submitter messages from spammers. Please disregard this message while I try to gather some information in the hopes of stopping

Re: Should we bundle the MaxMind GeoIP db?

Hi Victoria, On Wed, 30 May 2018, Victoria Risk wrote: ... would it be useful if we included the GeoLite2 database with the BIND distribution? Since we update at least twice a year, we could keep it fairly well up to date, and it would save users having to go get and update the db themselves.

Re: Fwd: Facing weird issue with DNS-RPZ

Hi there, On Wed, 25 Apr 2018, Blason R wrote: Unfortunately neither RHEL nor CentOS gives RPM for 9.10+ and really compiling and building is really pain and time consuming. Hence I decided to give a try with Ubuntu 16.04 and any ways within few days 18.04 is coming out with 9.11. Date: Wed,

Administrivia.

Hi there, It looks like something has recently changed in the ISC DNS. 8<-- Apr 20 09:00:36 mail6 sm-mta[20203]: NOQUEUE: connect from lists.isc.org [149.20.1.60] Apr 20 13:00:22 mail6 sm-mta[29448]: NOQUEUE: connect from

Re: Responding with a subset of an rrset

Hi there, On Wed, 11 Apr 2018, speijnik wrote: I'd need a way of returning a random pick of a limited number of records from a given rrset ... Something like this? 8<-- #!/usr/bin/perl -w use strict; use Net::DNS; use

Re: Separate DNS slaves as internal and external

Hi there, On Mon, 19 Mar 2018, King, Harold Clyde wrote: I have DNS slaves for internal and external entities. I don't know how to work the NS records so that outside users would only get the external slave and internal would only get the internal slave. How can I do this? ... You could use

RE: "Hiding" version.bind in /etc/bind/named.conf.options doesn't work

Hi there, On Wed, 28 Feb 2018, (Ing. Pedro Pablo Delgado Martell) wrote: Good morning, I'm trying to make it more difficult for an attacker to get my DNS server version. Waste of time. The attacks are automated, and will be mounted anyway. -- 73, Ged.

Re: DNS not resolving on google, but is on other services

Hi there, On Sat, 17 Feb 2018, LuKreme wrote: ... Is google just b0rked? ... You might need to look closer to home. You claim three nameservers, but it appears that they're all on the same network segment - a *really* bad idea - and one of them doesn't respond to DNS requests, using IPs

Re: disable dnssec for particular domain

Hi there, On Wed, 7 Feb 2018, Michelle Konzack wrote: ... Note: If someone is interested making a slave for me ... Is there a reason you don't use e.g. he.net? https://dns.he.net/ They do say of DNSSEC that they are "exploring this now" but it seems to work for me. -- 73, Ged.

Re: intermittent SERVFAIL for high visible domains such as *.google.com

Hi there, On Tue, 23 Jan 2018, Grant Taylor wrote: ... I'm sure that you could do some networking magic to cause connections to $AlternateIP port 53 to be re-routed to $DifferentIP $AlternatePort. http://netcat.sourceforge.net/ -- 73, Ged. ___

Re: DNSSEC validation without current time

Hi there, On Fri, 15 Dec 2017, Barry Margolin wrote: In article , "G.W. Haywood" wrote: On Fri, 15 Dec 2017, Petr Men??k wrote: ... current time is not available or can be inaccurate. ntpdate? I think the

Re: DNSSEC validation without current time

Hi there, On Fri, 15 Dec 2017, Petr Men??k wrote: ... current time is not available or can be inaccurate. ntpdate? -- 73, Ged. ___ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing

Re: Domain Not Resolving

Hi there, On Tue, 21 Nov 2017, Ron Wingfield wrote: ... our registered domain, archaxis.net, is not resolving ... As has been mentioned, you don't have a nameserver listening on IP 162.202.233.81. At a guess, you need to restart it. We run BIND version 9.10.2 ... Upgrade. See for