Re: [ga] Re: Resolving .gov w/dnssec

2010-04-23 Thread Joe Baptista
/22/10, Joe Baptista bapti...@publicroot.org* wrote: From: Joe Baptista bapti...@publicroot.org Subject: [ga] Re: Resolving .gov w/dnssec To: c...@cam.ac.uk, g...@gnso.icann.org GA g...@gnso.icann.org Cc: Paul Wouters p...@xelerance.com, Bind Users Mailing List bind-users@lists.isc.org

Re: Resolving .gov w/dnssec

2010-04-23 Thread Michael Sinatra
On 04/22/10 18:48, Timothe Litt wrote: I get a connection timed out; no servers could be reached after the Truncated, retrying in TCP mode even with +bufsiz=512 I get a correct response when I use +bufsiz=512. After Truncated, retrying in TCP mode I get a response, but apparently you don't.

Resolving .gov w/dnssec

2010-04-22 Thread Timothe Litt
I'm having trouble resolving uspto.gov with bind 9.6.1-P3 and 9.6-ESV configured as valdidating resolvers. Using dig, I get a connection timeout error after a long (~10 sec) delay. +cdflag provides an immediate response. state.gov does not get this error. Note that it uses different nameservers

Re: Resolving .gov w/dnssec

2010-04-22 Thread Paul Wouters
On Thu, 22 Apr 2010, Timothe Litt wrote: I'm having trouble resolving uspto.gov with bind 9.6.1-P3 and 9.6-ESV configured as valdidating resolvers. Using dig, I get a connection timeout error after a long (~10 sec) delay. +cdflag provides an immediate response. Is anyone else seeing this?

Re: Resolving .gov w/dnssec

2010-04-22 Thread Torsten
Am Thu, 22 Apr 2010 10:03:43 -0400 (EDT) schrieb Paul Wouters p...@xelerance.com: On Thu, 22 Apr 2010, Timothe Litt wrote: I'm having trouble resolving uspto.gov with bind 9.6.1-P3 and 9.6-ESV configured as valdidating resolvers. Using dig, I get a connection timeout error after a long

Re: Resolving .gov w/dnssec

2010-04-22 Thread Chris Thompson
On Apr 22 2010, Paul Wouters wrote: On Thu, 22 Apr 2010, Timothe Litt wrote: I'm having trouble resolving uspto.gov with bind 9.6.1-P3 and 9.6-ESV configured as valdidating resolvers. Using dig, I get a connection timeout error after a long (~10 sec) delay. +cdflag provides an immediate

Re: Resolving .gov w/dnssec

2010-04-22 Thread Joe Baptista
Looks like the future of the DNSSEC make work project includes resolution failures here and there. More security - less stability - guaranteed slavery. I wounder if it's a fair trade. we'll see .. regards joe baptista On Thu, Apr 22, 2010 at 10:52 AM, Chris Thompson c...@cam.ac.uk wrote: On

RE: Resolving .gov w/dnssec

2010-04-22 Thread Timothe Litt
.gov w/dnssec On Apr 22 2010, Paul Wouters wrote: On Thu, 22 Apr 2010, Timothe Litt wrote: I'm having trouble resolving uspto.gov with bind 9.6.1-P3 and 9.6-ESV configured as valdidating resolvers. Using dig, I get a connection timeout error after a long (~10 sec) delay. +cdflag provides

Re: Resolving .gov w/dnssec

2010-04-22 Thread Paul Wouters
On Thu, 22 Apr 2010, Chris Thompson wrote: I have the same problems with our validating unbound instance. I suspect that this has to do with dig +dnssec +norec dnskey uspto.gov @dns1.uspto.gov. dig +dnssec +norec dnskey uspto.gov @sns2.uspto.gov. failing with timeouts, while dig +dnssec

Re: Resolving .gov w/dnssec

2010-04-22 Thread Nate Itkin
On Thu, Apr 22, 2010 at 08:06:03AM -0400, Timothe Litt wrote: I'm having trouble resolving uspto.gov with bind 9.6.1-P3 and 9.6-ESV configured as valdidating resolvers. [snip] Is anyone else seeing this? Ideas on how to troubleshoot? Not specifically, but I log a lot of errors resolving in

Re: Resolving .gov w/dnssec

2010-04-22 Thread Casey Deccio
On Thu, Apr 22, 2010 at 11:17 AM, Nate Itkin bind-us...@konadogs.netwrote: Not specifically, but I log a lot of errors resolving in usps.gov. USPS clearly has configuration issues. A representative sample from my logs: 19-Apr-2010 11:04:23.072 lame-servers: no valid RRSIG resolving '

Re: Resolving .gov w/dnssec

2010-04-22 Thread Michael Sinatra
On 4/22/10 8:55 AM, Timothe Litt wrote: So, others are also seeing this, and it's not unique to bind or my corner of the internet. Thanks. It seems to have been going on for weeks, so it isn't going to fix itself. Who do I report this to so that it gets resolved? I have had good luck