Re: [help]how to configure ecs subnet for bind-9.18-21

2024-04-28 Thread Greg Choules
OK. Firstly, the bad news. ECS is only available in the subscription version of BIND. That is, versions ending with -S. To get this version you need a (paid) support contract with ISC. If you are interested, let me know. Secondly, 9.18.21 is not current. I would recommend that you use

Re: [help]how to configure ecs subnet for bind-9.18-21

2024-04-28 Thread Greg Choules
Hello. Do you mean 9.18-S1? > On 28 Apr 2024, at 08:06, Yang via bind-users > wrote: > > > dear admin: > now, i use bind-9.18-21, i want to use ecs client subnet function; but i > don't know how to configure it, and i don't get method from google > ple

[help]how to configure ecs subnet for bind-9.18-21

2024-04-28 Thread Yang via bind-users
dear admin: now, i use bind-9.18-21, i want to use ecs client subnet function; but i don't know how to configure it, and i don't get method from google please give me some example,or document , or google links to learn about it ; thanks! Yang 395096...@qq.com-- Visit https

Re: Observation: BIND 9.18 qname-minimization strict vs dig +trace

2024-04-26 Thread Havard Eidnes via bind-users
advertises itself as authoritative > for 85.191.131.in-addr.arpa Yep. Both of the resolveable NSes ns102.click-network.com and fs838.click-network.com claim authority over 191.131.in-addr.arpa, which they don't have according to the parent zone DNS delegations. Regards, - Håvard --

Re: Observation: BIND 9.18 qname-minimization strict vs dig +trace

2024-04-26 Thread Sten Carlsen
Trace from my location dies even earlier: ;; Received 915 bytes from 2001:503:c27::2:30#53(j.root-servers.net) in 17 ms ;; connection timed out; no servers could be reached Again just a data point. > On 24 Apr 2024, at 22.03, tale via bind-users > wrote: > > Hmm, I won

Re: Observation: BIND 9.18 qname-minimization strict vs dig +trace

2024-04-26 Thread Fred Morris
As further data points with BIND as a caching / recursive sometimes it "works" and provides inconsistent AUTHORITY, although anecdata suggests this is more prevalent with older versions of BIND. In one case BIND 9.12 reports the AUTHORITY as the parent zone in fact, with the parent's n

Re: Observation: BIND 9.18 qname-minimization strict vs dig +trace

2024-04-24 Thread Fred Morris
rather than the decision to stuff rabid weasels down your pants in the first place. -- Fred Morris On Wed, 24 Apr 2024, tale wrote: Hmm, I wonder if qname-minimisation is at issue here. -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds

Re: Observation: BIND 9.18 qname-minimization strict vs dig +trace

2024-04-24 Thread tale via bind-users
address for 'ns102.click-network.com': not found -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users

Observation: BIND 9.18 qname-minimization strict vs dig +trace

2024-04-24 Thread Fred Morris
While BIND 9.18.21 with "qname-minimization strict;" SERVFAILs on the following query, dig with +trace resolves it. Just a data point, and if they fix their s**t and stop impersonating a signed zone then presumably the example will resolve itself (pun intended). dig -x 131.191.85.

Re: BIND 9.16 is approaching EOL in April, 2024

2024-03-11 Thread Victoria Risk
> On Mar 11, 2024, at 4:09 PM, John Thurston wrote: > > I assume the day is approaching when the packages in the COPR repositories > will be changed; isc/bind-esv will have 9.18 (instead of 9.16), and ics/bind > will have 9.20 > > So that we might start weaving this

Re: BIND 9.16 is approaching EOL in April, 2024

2024-03-11 Thread John Thurston
I assume the day is approaching when the packages in the COPR repositories will be changed; isc/bind-esv will have 9.18 (instead of 9.16), and ics/bind will have 9.20 So that we might start weaving this into our maintenance plans, is there a projected date on which this will happen? -- Do

Re: Deprecation notice force BIND 9.20+: "rrset-order fixed" and "sortlist"

2024-03-01 Thread Marcus Kool
On 01/03/2024 11:02, Jim Reid wrote: On 1 Mar 2024, at 10:37, Greg Choules via bind-users wrote: In summary, Do the hard work of traffic steering somewhere else and let your DNS resolvers deliver the chosen answer. Don't make the resolvers themselves try to do this on the basis

Re: Deprecation notice force BIND 9.20+: "rrset-order fixed" and "sortlist"

2024-03-01 Thread Jim Reid
> On 1 Mar 2024, at 10:37, Greg Choules via bind-users > wrote: > > In summary, Do the hard work of traffic steering somewhere else and let your > DNS resolvers deliver the chosen answer. Don't make the resolvers themselves > try to do this on the basis of incomplete infor

Re: Deprecation notice force BIND 9.20+: "rrset-order fixed" and "sortlist"

2024-03-01 Thread Greg Choules via bind-users
e and load to consider. Might your tweaked responses just > send clients to a nearby but tragically overloaded server? > > My preference would be to let those people whose job it is to think > about this stuff - which, reading this list, clearly they do - get on > with their job. >

Re: Deprecation notice force BIND 9.20+: "rrset-order fixed" and "sortlist"

2024-03-01 Thread G.W. Haywood
onses just send clients to a nearby but tragically overloaded server? My preference would be to let those people whose job it is to think about this stuff - which, reading this list, clearly they do - get on with their job. Observations welcome of course. -- 73, Ged. -- Visit https://lists.isc.o

Re: Deprecation notice force BIND 9.20+: "rrset-order fixed" and "sortlist"

2024-03-01 Thread Matus UHLAR - fantomas
tu. Micro$oft random number generator: 0, 0, 0, 4.33e+67, 0, 0, 0... -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.

Deprecation notice force BIND 9.20+: "rrset-order fixed" and "sortlist"

2024-02-29 Thread Ondřej Surý
s in the DNS messages, it needs to be reported as a bug to the respective vendor. They will be deprecated as of BIND 9.20 and removed in BIND 9.22. Cheers, -- Ondřej Surý (He/Him) ond...@isc.org My working hours and your working hours may be different. Please do not feel obligated to reply outside your no

Re: BIND Upgrade

2024-02-28 Thread Petr Menšík
We are working intensively at Red Hat to finally fix that version. A huge thanks goes to ISC, which kindy provided complex backport into 9.11 version, which they do not support for a long time. It was discovered those changes require also changes to bind-dyndb-ldap used in freeipa and also

BIND 9.16 is approaching EOL in April, 2024

2024-02-26 Thread Victoria Risk
The BIND 9.16 release branch is approaching EOL as of April, 2024. We encourage users running 9.16 or (gasp) 9.11, to upgrade to 9.18. The 9.18 branch has consistently out-performed the 9.16 branch, and we are confident that it is more stable than 9.16. One of our support engineers has

Re: BIND Upgrade

2024-02-16 Thread G.W. Haywood
Hi there, On Fri, 16 Feb 2024, Semra T?rkkal Nazl?mo?lu wrote: Our bind version seems below. How can we upgrade bind version? And if we upgrade bind version, is there any problem? Recently I upgraded from 9.11.26 (not 9.11.36) to 9.18.24 using the source from the ISC Website. It's a very

Re: BIND Upgrade

2024-02-15 Thread Darren Ankney
Hi, You don't need to use the RHEL version of BIND. ISC supplies packages that you can add as described here: https://kb.isc.org/docs/isc-packages-for-bind-9 Thank you, Darren Ankney On Thu, Feb 15, 2024 at 8:02 AM Marco Moock wrote: > > Am 15.02.2024 schrieb Semra Türkkal Nazl

Re: BIND Upgrade

2024-02-15 Thread Marco Moock
Am 15.02.2024 schrieb Semra Türkkal Nazlımoğlu : > Our bind version seems below. How can we upgrade bind version? It comes from the OS you are using. Upgrade to the current RHEL release. If you prefer bleeding-edge versions, use Fedora instead. > And if we upgrade bind version, is the

BIND Upgrade

2024-02-15 Thread Semra Türkkal Nazlımoğlu
Hello, Our bind version seems below. How can we upgrade bind version? And if we upgrade bind version, is there any problem? [root@ns2 ~]# named -v BIND 9.11.36-RedHat-9.11.36-11.el8_9 (Extended Support Version) Thanks Semra -- Visit https://lists.isc.org/mailman/listinfo/bind-users

Re: Problems with openssl pkgconfig in bind 9.18.21 (but probably all 9.18) {External}

2023-12-22 Thread Ondřej Surý
o reply outside your normal working hours. > On 22. 12. 2023, at 16:44, William D. Colburn wrote: > > Your build system did say to manually change it. I used an environment > variable, but thought (still think actually) that yhour build system > should honor pkgconfig for findi

Re: Problems with openssl pkgconfig in bind 9.18.21 (but probably all 9.18) {External}

2023-12-22 Thread William D. Colburn
On Fri, Dec 22, 2023 at 05:43:09PM +0100, Ond??ej Surý wrote: >No, you missed my point - I asked why do you pretend to run stuff on RHEL 6 >while in fact you do not because all the critical libraries are self-compiled. > >You can run BIND 9 in a container (on RHEL 6) using a stil

Re: Problems with openssl pkgconfig in bind 9.18.21 (but probably all 9.18) {External}

2023-12-22 Thread Ondřej Surý
Please keep Cc when responding to a message from the mailing list. Re-added, but redacted most of your email. No, you missed my point - I asked why do you pretend to run stuff on RHEL 6 while in fact you do not because all the critical libraries are self-compiled. You can run BIND 9

Re: Problems with openssl pkgconfig in bind 9.18.21 (but probably all 9.18)

2023-12-22 Thread Ondřej Surý
hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours. > On 22. 12. 2023, at 16:14, William D. Colburn wrote: > > I'm compiling bind 9.18.21 on RHEL 6.10. I had to make my own libuv and > openssl packages (and I still nee

Problems with openssl pkgconfig in bind 9.18.21 (but probably all 9.18)

2023-12-22 Thread William D. Colburn
I'm compiling bind 9.18.21 on RHEL 6.10. I had to make my own libuv and openssl packages (and I still need a jemalloc package). I told bind about them via the PKG_CONFIG_PATH variable, which mostly works. The problem is in bind-9.18.21/doc/misc which doesn't seem to receive any information from

Re: Deprecation notice for BIND 9: "resolver-nonbackoff-tries", "resolver-retry-interval"

2023-12-08 Thread Evan Hunt
zing for, why, and how? In this case, merely optimizing for the number of things we on the BIND development team need to test and maintain. I really don't think anyone's using these knobs, so they might as well not be there. They were added during the development process for serve-stale, which

Re: Deprecation notice for BIND 9: "resolver-nonbackoff-tries", "resolver-retry-interval"

2023-12-08 Thread G.W. Haywood
to see it played out on this list (if the Ps that B think it appropriate). -- 73, Ged. -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact

Re: Deprecation notice for BIND 9: "resolver-nonbackoff-tries", "resolver-retry-interval"

2023-12-07 Thread Petr Špaček
ing we can from statistics provided by DNS Shotgun [1], BIND statistics channel [2], and system resource monitoring [3]. [1] https://dns-shotgun.readthedocs.io/en/stable/ [2] https://bind9.readthedocs.io/en/v9.19.18/reference.html#namedconf-statement-statistics-channels [3] https://gitlab.i

Re: Deprecation notice for BIND 9: "resolver-nonbackoff-tries", "resolver-retry-interval"

2023-12-07 Thread Fred Morris
it should be limited to that use case? Why aren't there tuning / configuration options around this? (Won't be surprised if there are for at least some implementations.) If this resonates with you, feel free to reach out. If you use the trualias morris.dns.systems.thinking@m3047.net that will help

Re: Deprecation notice for BIND 9: "resolver-nonbackoff-tries", "resolver-retry-interval"

2023-12-07 Thread Petr Špaček
et Systems Consortium -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users mailing list bind-users@lists.isc

Re: Deprecation notice for BIND 9: "resolver-nonbackoff-tries", "resolver-retry-interval"

2023-12-06 Thread Fred Morris
imizing for, why, and how? Thanks... -- Fred Morris -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users ma

Deprecation notice for BIND 9: "resolver-nonbackoff-tries", "resolver-retry-interval"

2023-12-06 Thread Evan Hunt
They are not thought to be useful in a production environment, and we know of no operators using them. (Please let us know if this is incorrect!) Our plan is to mark these options as deprecated in BIND 9.16 and 9.18, and to remove them as of BIND 9.20. -- Evan Hunt -- e...@isc.org Internet Systems Consor

Re: Question on ISC BIND DNS Server

2023-11-22 Thread Turritopsis Dohrnii Teo En Ming
an. > > > >Can I upgrade BIND DNS Server manually? Will it cause problems with > >Virtualmin / Webmin? > > > I think this is question for webmin/virtualmin, but from what I know about > webmin it tends to edit local configuration, so I guess it will edit primary >

Re: Question on ISC BIND DNS Server

2023-11-22 Thread Matus UHLAR - fantomas
On 22.11.23 23:44, Turritopsis Dohrnii Teo En Ming wrote: I have Virtualmin / Webmin web hosting server control panel. I have 2 Virtual Private Servers in Germany and 1 Virtual Private Server in Japan. Can I upgrade BIND DNS Server manually? Will it cause problems with Virtualmin / Webmin? I

Question on ISC BIND DNS Server

2023-11-22 Thread Turritopsis Dohrnii Teo En Ming
Subject: Question on ISC BIND DNS Server Good day from Singapore, I have Virtualmin / Webmin web hosting server control panel. I have 2 Virtual Private Servers in Germany and 1 Virtual Private Server in Japan. Can I upgrade BIND DNS Server manually? Will it cause problems with Virtualmin

Re: Problem with recursion for windows bind for Teamviewer

2023-11-20 Thread legacyone via bind-users
So here is a theory if a client asks a query and bind goes out for that query and the reply is delayed but you get the answer then for what ever reason the reply to the client from bind is delayed more! So the quicker the answer the quicker the answer to the client. Why? I have no idea

Re: Problem with recursion for windows bind for Teamviewer

2023-11-20 Thread legacyone via bind-users
and this from dig maybe a routing iusse why it take so long for me? C:\Program Files\ISC BIND 9\bin>dig @213.227.191.1 router14.teamviewer.com +norecurs ; <<>> DiG 9.16.45 <<>> @213.227.191.1 router14.teamviewer.com +norecurs ; (1 server found) ;; global

Re: Problem with recursion for windows bind for Teamviewer

2023-11-20 Thread legacyone via bind-users
This is the thing the setup works for many site fast just this Teamviewer and their DNS servers are a problem and bind does reply to 192.168.53.19 all be it 26 seconds later! but Teamviewer trys over and over then it connects yet the for the WAN side took under 4 seconds to get the answer WAN

Re: Problem with recursion for windows bind for Teamviewer

2023-11-20 Thread Greg Choules via bind-users
are going, whether you receive ICMP unreachables or retries etc. Also do some tests. If you have BIND you should also have dig. If you don't have dig, use Windows nslookup in interactive mode and send queries to the teamviewer NSs. Right now I would prove that the network is clean first. I see no reason to

Re: Problem with recursion for windows bind for Teamviewer

2023-11-20 Thread legacyone via bind-users
This might show the problem even more on two interfaces WAN side and LAN you can see 192.168.53.19 ask for routerpool8 #60 then bind goes out #62 gets a answer # 75 and no reply back to 192.168.53.19 https://ufile.io/v8oob3jg -- Visit https://lists.isc.org/mailman/listinfo/bind-users

Re: Problem with recursion for windows bind for Teamviewer

2023-11-20 Thread legacyone via bind-users
On starting Teamviewer it can say no connection when bind does the lookup with this delay it cause bind to not reply LAN side sometimes which causes the app to fail yet with a bind on Ubuntu there is no problem. -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from

Re: Problem with recursion for windows bind for Teamviewer

2023-11-20 Thread legacyone via bind-users
I'm just using bind to do my DNS look ups with no forwarders thats all Teamviewer app uses DNS to find its servers from what I can tell it can take over 4000ms to get a answer. The following seems to help in bind resolver-retry-interval 5000; I think if I can then find a setting in windows

Re: Problem with recursion for windows bind for Teamviewer

2023-11-20 Thread Greg Choules via bind-users
Hi there. Can you send some information, for those unfamiliar with what you're trying to do? - Full BIND config - IP addresses of relevant things, like interfaces of the servers on which you are running BIND and of Teamviewer. - What does Teamviewer need from DNS? What kinds of queries

Re: Problem with recursion for windows bind for Teamviewer

2023-11-20 Thread legacyone via bind-users
Now its not working fast again! I don't know now must be Teamviewer DNS delaying replies causing windows bind to fail in some way. -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions

Re: Problem with recursion for windows bind for Teamviewer

2023-11-20 Thread legacyone via bind-users
So more tests and the problem has come back but I think I know why thinking internet sharing was the problem I found a way to disable it because it bind shared access for port 53 on 0.0.0.0 so that the problem I think now after testing with it on. For any interested MS has made it really hard

Re: Problem with recursion for windows bind for Teamviewer

2023-11-20 Thread legacyone via bind-users
I'm by no means an expert in DNS or how it fully works so I can't be of any more help about this problem then I already have. But it seems Teamviewer have rebooted their DNS servers and now windows bind allows the Teamviewer to load faster -- Visit https://lists.isc.org/mailman/listinfo/bind

Re: Problem with recursion for windows bind for Teamviewer

2023-11-19 Thread Ondřej Surý
Hey, BIND 9.16 is in security-and-critical-only mode, so this won’t get fixed in any case. However, your message is incomprehensible. If you want to get anything fixed, we will need more clarity in the report - describe your setup (clients, recursive servers, authoritative servers

Problem with recursion for windows bind for Teamviewer

2023-11-19 Thread legacyone via bind-users
I don't know if this will be fixed before EOL for windows bind but here is the problem Teamviewer (and maybe other sites too) when you do the recursion when no answer under 1000ms it tries again which is trigged by client windows (not the one running bind) which also tries again for a answer

Re: BIND-9.10.2-P4: Cannot use in-view to refer to RPZ zone definitions: "'$RPZ_ZONE' is not a master or slave zone"

2023-11-10 Thread Lannar Dean via bind-users
missing something. Is there some other mechanism to achieve this end result (sharing zones between different user populations without loading multiple copies of the zone into memory)? I am currently running BIND 9.16.44 by the way. Thanks for any advice! -- Visit https://lists.isc.org/mailman/list

Re: Can we enable serve-stale parameter in bind

2023-11-05 Thread Ondřej Surý
engineering in the first place. Ondřej -- Ondřej Surý — ISC (He/Him) My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours. > On 6. 11. 2023, at 3:04, Prasanna Mathivanan (pmathiva) via bind-users > wrote: > >

Can we enable serve-stale parameter in bind

2023-11-05 Thread Prasanna Mathivanan (pmathiva) via bind-users
://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman

Re: 9.18 BIND not resolving .gov.bd site

2023-10-30 Thread Mosharaf Hossain
NS ns2.bcc.gov.bd. > > couldn't get address for 'ns1.bcc.gov.bd': not found > > couldn't get address for 'ns2.bcc.gov.bd': not found > > dig: couldn't get address for 'ns1.bcc.gov.bd': no more > > root@ns1:/etc/bind# > > So you got this this point and that is sayi

Re: 9.18 BIND not resolving .gov.bd site

2023-10-30 Thread Mark Andrews
s for 'ns2.bcc.gov.bd': not found > dig: couldn't get address for 'ns1.bcc.gov.bd': no more > root@ns1:/etc/bind# So you got this this point and that is saying that the lookup of the addresses of the nameservers is failing. The next step would to do a 'dig +trace' or a 'dig +trace +all' of tho

Re: 9.18 BIND not iterated over all authoritative nameservers

2023-10-30 Thread Rainer Duffner
> Am 30.10.2023 um 16:59 schrieb Michael Martinell via bind-users > : > > Thanks to all who responded. Putting qname-minimization disabled; in > named.conf resolves the issue in my testing. > > I did try specifying relaxed (which appears to be the default), but that

RE: 9.18 BIND not iterated over all authoritative nameservers

2023-10-30 Thread Michael Martinell via bind-users
, but it will take a large company to push them to do so. Michael Martinell Network/Broadband Technician Interstate Telecommunications Coop., Inc. From: bind-users On Behalf Of Paul Stead Sent: Saturday, October 28, 2023 11:35 AM Cc: bind-users@lists.isc.org Subject: Re: 9.18 BIND not iterated

Re: 9.18 BIND not resolving .gov.bd site

2023-10-30 Thread Timothe Litt
for 'ns2.bcc.gov.bd': not found dig: couldn't get address for 'ns1.bcc.gov.bd': no more root@ns1:/etc/bind# I can resolve them, but only A records exist. Please try it again. dig a ns2.bcc.gov.bd When encountering these sorts of errors, particularly if not a DNS expert, the easiest diagnostic

Re: 9.18 BIND not resolving .gov.bd site

2023-10-30 Thread Lefteris Tsintjelis via bind-users
ain: mofa.gov.bd.86400 IN NS ns1.bcc.gov.bd. mofa.gov.bd.86400 IN NS ns2.bcc.gov.bd. couldn't get address for 'ns1.bcc.gov.bd': not found couldn't get address for 'ns2.bcc.gov.bd': not found dig: couldn't get address for 'ns1.bcc.gov.bd': no more root

Re: 9.18 BIND not resolving .gov.bd site

2023-10-30 Thread Marco M.
': not found > dig: couldn't get address for 'ns1.bcc.gov.bd': no more > root@ns1:/etc/bind# I can resolve them, but only A records exist. Please try it again. dig a ns2.bcc.gov.bd -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC fun

9.18 BIND not resolving .gov.bd site

2023-10-30 Thread Mosharaf Hossain
Hi Recently I installed BIND 9.18 in the debina12 server and everything is working fine except .gov.bd sites. Following are some reports attached for your reference. Kindly help me to identify the reason. [image: image.png] root@ns1:/etc/bind# dig mofa.gov.bd +trace ; <<>> DiG 9.18.

Re: 9.18 BIND not iterated over all authoritative nameservers

2023-10-28 Thread Paul Stead
are seem to follow Postel's Law > moreso than BIND. > > I agree this perpetuates bad practices but end users aren't interested in > technical reasoning, especially when "it works everywhere else, you must be > broken" > > Paul > > > On Sat, Oct 28, 2023,

Re: 9.18 BIND not iterated over all authoritative nameservers

2023-10-28 Thread Ondřej Surý
not a new requirement.  It has been this waysince the very beginning.The bank needs to fix what they publish.MarkOn 28 Oct 2023, at 02:36, Michael Martinell via bind-users <bind-users@lists.isc.org> wrote:Hello, At this point I am hoping that somebody might have a workaround so that we can exclud

Re: 9.18 BIND not iterated over all authoritative nameservers

2023-10-28 Thread Paul Stead
As a previous ISP admin I too have come across similar situations and frustrations. I can only say that Google and Cloudflare seem to follow Postel's Law moreso than BIND. I agree this perpetuates bad practices but end users aren't interested in technical reasoning, especially when "it

Re: 9.18 BIND not iterated over all authoritative nameservers

2023-10-28 Thread Rick Frey
the very beginning. > > The bank needs to fix what they publish. > > Mark > >> On 28 Oct 2023, at 02:36, Michael Martinell via bind-users >> wrote: >> >> Hello, >> At this point I am hoping that somebody might have a workaround so that we >>

Re: 9.18 BIND not iterated over all authoritative nameservers

2023-10-27 Thread Mark Andrews
n they should expect lookups to fail. The NS records on both sides of a zone cut are supposed to be IDENTICAL. This is not a new requirement. It has been this way since the very beginning. The bank needs to fix what they publish. Mark > On 28 Oct 2023, at 02:36, Michael Martine

Re: 9.18 BIND not iterated over all authoritative nameservers

2023-10-27 Thread Lyle Giese
server and responsible party records are not resolvable. Maybe someone with more knowledge of DNS and the use of .local. domain name can shed some light on this. Lyle Giese On 10/27/23 10:36, Michael Martinell via bind-users wrote: Hello, At this point I am hoping that somebody might have

9.18 BIND not iterated over all authoritative nameservers

2023-10-27 Thread Michael Martinell via bind-users
Hello, At this point I am hoping that somebody might have a workaround so that we can exclude domains from this behavior if they are broken on the far end. Does anybody have a workaround for this? We are a small ISP and run BIND compiled from source. We currently run 9.16.x Every time we try

Re: bind9 service problem with BIND 9.10.3

2023-10-14 Thread Ondřej Surý
You are using an end-of-life BIND 9 on end-of-life Ubuntu. Start with that…There is no point in debugging a version with unfixed bugs and security vulnerabilities.Ondřej --Ondřej Surý — ISC (He/Him)My working hours and your working hours may be different. Please do not feel obligated to reply

bind9 service problem with BIND 9.10.3

2023-10-14 Thread Mosharaf Hossain
000=AFQjCNGMxIuHSHsD3qO6y5JddpEZ0S592A> -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users mailing list bind

Re: Bind forgets my changes with nsupdate

2023-10-08 Thread Michael Richardson
| ruby on rails[ signature.asc Description: PGP signature -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more inform

Re: Bind forgets my changes with nsupdate

2023-10-07 Thread Björn Persson
Paul van der Vlis via bind-users wrote: > But how could I refresh the key without loosing the IP? I was in a similar situation. I managed my zone files mostly manually, but a few records needed to be updated automatically. Either manual changes would obliterate automatically updated reco

Re: Bind forgets my changes with nsupdate

2023-10-06 Thread 201907-bind
o refresh my > certificates. Not perfect? What issues did you see? Thanks! -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for m

Re: Bind forgets my changes with nsupdate

2023-10-06 Thread Michael Richardson
exclusive dynamic update. This isn't perfect, but it works well enough to allow dns-01 (certbot/LetsEncrypt) to be able to refresh my certificates. signature.asc Description: PGP signature -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds

Re: Bind forgets my changes with nsupdate

2023-10-06 Thread Mark Andrews
me find the reason. See my other message. > > With regards, > Paul > > > -- > Paul van der Vlis Linux systeembeheer Groningen > https://vandervlis.nl/ -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development

Re: Bind forgets my changes with nsupdate

2023-10-06 Thread Paul van der Vlis via bind-users
https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users mailing list bind-users@lists.isc.org https://lists.isc.org

Re: Bind forgets my changes with nsupdate

2023-10-06 Thread Paul van der Vlis via bind-users
Op 06-10-2023 om 10:28 schreef Paul van der Vlis via bind-users: Hello, I try to give a dynamic IP to a name, using nsupdate. This works fine, but after some hours the IP is gone from the master (which I update). Something like this: Host home.customer.nl not found: 3(NXDOMAIN) The IP

Re: Bind forgets my changes with nsupdate

2023-10-06 Thread Mark Andrews
You need to figure out what is updating the zone. This isn’t named. -- Mark Andrews > On 6 Oct 2023, at 19:28, Paul van der Vlis via bind-users > wrote: > > Hello, > > I try to give a dynamic IP to a name, using nsupdate. This works fine, but > after some hour

Bind forgets my changes with nsupdate

2023-10-06 Thread Paul van der Vlis via bind-users
about the removal in the logs. But I saw a "freeze" and a "thaw" in the logs for the domain. Any idea why the IP removes after some time? With regards, Paul van der Vlis -- Paul van der Vlis Linux systeembeheer Groningen https://vandervlis.nl/ -- Visit https://lis

Re: Is bind 9.18.19 a validating resolver to shield against CVE-2023-42119 ?

2023-10-03 Thread Rob van der Putten via bind-users
Hi there On 02/10/2023 11:06, Kurt Jaeger wrote: In the light of the recent exim security issues[1,2] I'm trying to find out if bind 9.18.19, if used as resolver, does enough validation to shield exim instances from CVE-2023-42119 ? I added 'check-names response fail;' to the internal view

Re: Is bind 9.18.19 a validating resolver to shield against CVE-2023-42119 ?

2023-10-03 Thread Petr Menšík
original responses from upstream, unless it cached it already. So with BIND it should be better, but no guarantees given. Local validating resolver should help in any case. But without more detailed information about the vulnerability, we are just guessing. Best Regards, Petr On 02. 10. 23

Re: Is bind 9.18.19 a validating resolver to shield against CVE-2023-42119 ?

2023-10-02 Thread Petr Špaček
On 02. 10. 23 11:06, Kurt Jaeger wrote: Hi! In the light of the recent exim security issues[1,2] I'm trying to find out if bind 9.18.19, if used as resolver, does enough validation to shield exim instances from CVE-2023-42119 ? As details and reproducers for the CVE are not available

Is bind 9.18.19 a validating resolver to shield against CVE-2023-42119 ?

2023-10-02 Thread Kurt Jaeger
Hi! In the light of the recent exim security issues[1,2] I'm trying to find out if bind 9.18.19, if used as resolver, does enough validation to shield exim instances from CVE-2023-42119 ? As details and reproducers for the CVE are not available, this is a more general question. Pointers on where

RE: [EXTERNAL] bind-users Digest, Vol 4327, Issue 1

2023-09-27 Thread Lenny Rollison
Unsubscribe From: bind-users On Behalf Of bind-users-requ...@lists.isc.org Sent: Wednesday, September 27, 2023 4:02 PM To: bind-users@lists.isc.org Subject: [EXTERNAL] bind-users Digest, Vol 4327, Issue 1 Send bind-users mailing list submissions to bind-users@ lists. isc. org To subscribe

Re: Dnstap Re: Deprecation notice for BIND 9.20+: Unix Domain Sockets for control channel (rndc)

2023-09-12 Thread Ondřej Surý
but I'd rather not have fire drills (and it's not just > me it's people / projects downstream of me). > > FTR, I've always used an IP address with RNDC. > > On Tue, 12 Sep 2023, Ondřej Surý wrote: >> >> [...] The support for Unix >> Domain Sockets is already non

Dnstap Re: Deprecation notice for BIND 9.20+: Unix Domain Sockets for control channel (rndc)

2023-09-12 Thread Fred Morris
an IP address with RNDC. On Tue, 12 Sep 2023, Ondřej Surý wrote: [...] The support for Unix Domain Sockets is already non-operational since BIND 9.18.0 and it is a fatal error in named. This is properly documented in BIND 9.18.0 release notes and known issues. We are now proceeding to complete

Deprecation notice for BIND 9.20+: Unix Domain Sockets for control channel (rndc)

2023-09-12 Thread Ondřej Surý
Hello, in line with out deprecation policy, I am notifying the mailing list about deprecation of the 'unix' clause in the controls {} configuration block. The support for Unix Domain Sockets is already non-operational since BIND 9.18.0 and it is a fatal error in named. This is properly

Deprecation notice force BIND 9.20+: dnssec-must-be-secure option

2023-09-04 Thread Ondřej Surý
Hello, in line with out deprecation policy, I am notifying the mailing list about our preliminary intent to deprecate the 'dnssec-must-be-secure' option. The option will be marked as deprecated (causing warning from named-checkconf) in BIND 9.18 and 9.20 and it will be removed in BIND 9.21

Re: BIND 9.18 unable to successfully transfer zone from axfrdns primary

2023-08-31 Thread Michael Sinatra
Right, BIND 9.18 now enforces Section 2.2 of RFC 5936, specifically, this: "The AXFR server MUST copy the Question section from the corresponding AXFR query message into the first response message's Question section. For subsequent messages, it MAY do the same or leave the Que

Re: BIND 9.18 unable to successfully transfer zone from axfrdns primary

2023-08-31 Thread Ian Bobbitt
. On 1 Sep 2023, at 09:23, Ian Bobbitt wrote: I have a system running BIND 9.18.17 that needs to transfer a zone from djbdns/axfrdns. I receive FORMERRs, and haven't been able to get any log messages indicating the problem. xfer-in: info: zone example.net/IN: Transfer started. xfer-in: info

Re: BIND 9.18 unable to successfully transfer zone from axfrdns primary

2023-08-31 Thread Mark Andrews
023, at 09:23, Ian Bobbitt wrote: > > I have a system running BIND 9.18.17 that needs to transfer a zone from > djbdns/axfrdns. I receive FORMERRs, and haven't been able to get any log > messages indicating the problem. > > xfer-in: info: zone example.net/IN: Transfer sta

BIND 9.18 unable to successfully transfer zone from axfrdns primary

2023-08-31 Thread Ian Bobbitt
I have a system running BIND 9.18.17 that needs to transfer a zone from djbdns/axfrdns. I receive FORMERRs, and haven't been able to get any log messages indicating the problem. xfer-in: info: zone example.net/IN: Transfer started. xfer-in: info: transfer of 'example.net/IN' from 198.51.100.1

Re: bind-users Digest, Vol 4302, Issue 1

2023-08-21 Thread Timothe Litt
shed Engineer -- This communication may not represent the ACM or my employer's views, if any, on the matters discussed. On 21-Aug-23 18:56, bind-users-requ...@lists.isc.org wrote: Send bind-users mailing list submissions to bind-users@lists.isc.org To subsc

RE: monitoring BIND

2023-08-04 Thread sami . rahal
 : vendredi 4 août 2023 07:34 À : RAHAL Sami SOFRECOM Cc : bind-users@lists.isc.org Objet : Re: monitoring BIND > On 3 Aug 2023, at 17:07, sami.ra...@sofrecom.com wrote: > > Hello comunity > please what is the most recommended tool for BIND monitoring and especially > displa

RE: monitoring BIND

2023-08-04 Thread sami . rahal
SOFRECOM Cc : bind-users@lists.isc.org Objet : Re: monitoring BIND Maybe start with https://kb.isc.org/docs/monitoring-recommendations-for-bind-9 On Thu, Aug 3, 2023 at 9:07 AM mailto:sami.ra...@sofrecom.com>> wrote: Hello comunity please what is the most recommended tool for BIND moni

Re: monitoring BIND

2023-08-04 Thread Borja Marcos
> On 3 Aug 2023, at 17:07, sami.ra...@sofrecom.com wrote: > > Hello comunity > please what is the most recommended tool for BIND monitoring and especially > display response time and latency thank you in advance. For latency, your friend is Dnstap. The implementation on Bind

Re: monitoring BIND

2023-08-03 Thread Andrew Latham
Maybe start with https://kb.isc.org/docs/monitoring-recommendations-for-bind-9 On Thu, Aug 3, 2023 at 9:07 AM wrote: > > > Hello comunity > > please what is the most recommended tool for BIND monitoring and > especially display response time and latency thank you in advance

monitoring BIND

2023-08-03 Thread sami . rahal
Hello comunity please what is the most recommended tool for BIND monitoring and especially display response time and latency thank you in advance. Regards Sami -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software

Deprecation notice for BIND 9.20+: "dialup", "heartbeat-interval"

2023-08-01 Thread Evan Hunt
rvers, into clusters for the benefit of servers that only have intermittent connectivity to the internet. This is no longer a common enough scenario to justify the added code complexity. They will be deprecated as of BIND 9.20 and removed in BIND 9.22. -- Evan Hunt -- e...@isc.org Internet Sys

  1   2   3   4   5   6   7   8   9   10   >