RE: bindvrs Vulnerability

2010-01-12 Thread Lightner, Jeff
Sometimes you have to do things like hiding your version just because it came up on the security audit. It's a lot easier to make them shut up by doing what they want than by explaining to them that what they want is meaningless. -Original Message- From:

RE: Server overwhelmed by rejections?

2010-01-19 Thread Lightner, Jeff
Luckily my machines have enough horsepower not to shut down from this but I have on occasion seen the CPU load start going up due to it. On lowered powered machines this would likely cause what you're seeing. If you're running a firewall (external device or iptables on Linux) the best way to

RE: Server overwhelmed by rejections?

2010-01-20 Thread Lightner, Jeff
] On Behalf Of Matus UHLAR - fantomas Sent: Wednesday, January 20, 2010 3:53 AM To: bind-users@lists.isc.org Subject: Re: Server overwhelmed by rejections? On 19.01.10 08:29, Lightner, Jeff wrote: Luckily my machines have enough horsepower not to shut down from this but I have on occasion seen the CPU

RE: Host/nslookup/dig queries wrong server

2010-02-03 Thread Lightner, Jeff
it is at least I can look at upgrading or downgrading to solve the issue. -Original Message- From: Lightner, Jeff [mailto:jlight...@water.com] Sent: 03 February 2010 15:37 To: Duncan Berriman; bind-users@lists.isc.org Subject: RE: Host/nslookup/dig queries wrong server Interesting

RE: Host/nslookup/dig queries wrong server

2010-02-04 Thread Lightner, Jeff
I'm assuming you downloaded the ISC source rather than RedHat or CentOS. RedHat back ports bug and security fixes from later BIND versions into their BIND 9.3.6 implementation (which is why there is extra versioning in their package names). Since CentOS is built from RedHat source and both

RE: query (cache) 'xxxxxxxxxxxx/A/IN' denied

2010-02-09 Thread Lightner, Jeff
It changed between 9.3 and 9.4. See this link: http://support.menandmice.com/jforum/posts/list/25.page -Original Message- From: bind-users-bounces+jlightner=water@lists.isc.org [mailto:bind-users-bounces+jlightner=water@lists.isc.org] On Behalf Of Riccardo Castellani Sent:

RE: Query denied errors on PTR records for delegated zone

2010-02-23 Thread Lightner, Jeff
I'm running 9.3 on RHEL 5.4. My options are: options { directory /var/named; query-source address 10.0.0.3; allow-query { internaldns; externaldns; dswadnsalias; }; allow-recursion { internaldns; externaldns; }; blackhole { blackhats; }; version

RE: no hostname become unresolvable.

2010-02-23 Thread Lightner, Jeff
You need an A record for the domain itself: superease.net. IN A 202.68.195.36 www IN A 202.68.195.36 The first one (terminated by the dot) tells it lookup for the domain name superease.net itself. The dot is important - without it this would try to lookup

RE: no hostname become unresolvable.

2010-02-23 Thread Lightner, Jeff
to the same IP for the domain. -Original Message- From: Stephane Bortzmeyer [mailto:bortzme...@nic.fr] Sent: Tuesday, February 23, 2010 10:01 AM To: Lightner, Jeff Cc: Cefull Lo; bind-users@lists.isc.org Subject: Re: no hostname become unresolvable. On Tue, Feb 23, 2010 at 09:50:29AM

RE: Query denied errors on PTR records for delegated zone

2010-02-24 Thread Lightner, Jeff
it as if it is a non-issue but I suspect they'd balk at such a request. -Original Message- From: Jonathan de Boyne Pollard [mailto:j.deboynepollard-newsgro...@ntlworld.com] Sent: Wednesday, February 24, 2010 4:36 AM To: Lightner, Jeff; BIND users mailing list Subject: Re: Query denied

RE: OpenDNS today announced it has adopted DNSCurve to secure DNS

2010-02-24 Thread Lightner, Jeff
From the BCP79 referenced at top of the draft: d. Internet-Draft: temporary documents used in the IETF and RFC Editor processes. Internet-Drafts are posted on the IETF web site by the IETF Secretariat and have a nominal maximum lifetime in the Secretariat's public directory of

RE: recursion

2010-03-10 Thread Lightner, Jeff
Modern being? -Original Message- From: bind-users-bounces+jlightner=water@lists.isc.org [mailto:bind-users-bounces+jlightner=water@lists.isc.org] On Behalf Of Alan Clegg Sent: Wednesday, March 10, 2010 2:25 PM To: bind-users@lists.isc.org Subject: Re: recursion ic.nssip wrote:

RE: Split View DNS

2010-03-11 Thread Lightner, Jeff
I too found it best to have them be separate even if they contain the same data. For me I had an internal and external view - the external was my original zone so I made that my external view then simply prepended internal- to the zone file name in the internal view. That way all my intenal

RE: T_ANY

2010-03-19 Thread Lightner, Jeff
Maybe it's a difference between udp and tcp in your firewall? For most queries udp 53 is used but for long packets it might switch to tcp 53 - since you're doing an any you're going to get a lot more data. -Original Message- From: bind-users-bounces+jlightner=water@lists.isc.org

RE: T_ANY

2010-03-22 Thread Lightner, Jeff
Anyway his issue wasn't with Qmail (if it had been internal lookups would have failed as well). It was before that while trying to do a DNS resolution. As OP indicated it turned out it was a rule in his PIX blocking it from external so it wasn't really a BIND issue either. -Original

RE: problem with notifies

2010-04-01 Thread Lightner, Jeff
The CentOS stuff is built from RHEL sources so the basic repositories wouldn't have a newer BIND base package than RHEL. However, as noted previously the RHEL provided package includes backports of later BIND base versions for bug and security fixes. Of course you can always install a later BIND

RE: Load Balancer for DNS

2010-04-05 Thread Lightner, Jeff
That answer seems to imply that when load is high enough on existing caching servers the traffic will go to the others. Is that the case? At what point does this occur? -Original Message- From: bind-users-bounces+jlightner=water@lists.isc.org

RE: Unexpected issues with nslookup command

2010-04-16 Thread Lightner, Jeff
Did I misread your original problem? I thought you said it worked if you had only one of the nameservers in resolv.conf. You didn't state but I assume (that word again) that you meant if either of your nameservers was there by itself it worked? Why would a recursion issue not come into play

RE: dig +trace to find all the forwarders?

2010-04-26 Thread Lightner, Jeff
? That link only shows the IP you came from and does a reverse lookup on it. It doesn't seem to say anything about the nameserver. -Original Message- From: bind-users-bounces+jlightner=water@lists.isc.org [mailto:bind-users-bounces+jlightner=water@lists.isc.org] On Behalf Of

RE: dig +trace to find all the forwarders?

2010-04-26 Thread Lightner, Jeff
I'm sure that's all it displayed when I went to it from my Windows desktop's browser. -Original Message- From: Warren Kumari [mailto:war...@kumari.net] Sent: Monday, April 26, 2010 2:20 PM To: Lightner, Jeff Cc: Josh Kuo; bind-us...@isc.org Subject: Re: dig +trace to find all

RE: bind multi-threaded question

2010-04-28 Thread Lightner, Jeff
On most *nixes ps only shows the process and not the thread though they may have tools to see thread information. Linux will show you the threads as if they were processes. From CentOS5 (linux) man page: To get info about threads: ps -eLf ps axms

RE: Preparing for upcoming DNSSEC changes on 5/5

2010-05-03 Thread Lightner, Jeff
I fear I've missed something important. My Network admin is saying his understanding is we MUST make changes for this 5/5 change on the root servers. I was under the impression that until we decide to implement DNSSEC ourselves we don't need to do anything on our end to continue resolving.

RE: Preparing for upcoming DNSSEC changes on 5/5

2010-05-03 Thread Lightner, Jeff
:36 PM, Lightner, Jeff wrote: It sounds as if he read an article saying we have to implement DNSSEC on our DNS servers or we'll quit working on 5/5? Is that the case? Also what is the drop dead date/time if so? 5/5 Midnight UTC? Some other time? You don't need to do anything more than

RE: Preparing for upcoming DNSSEC changes on 5/5

2010-05-03 Thread Lightner, Jeff
To follow up on Peter's question what does it mean if one sees the reply size limit is at least with a value lower than the advertised EDNS buffer size? This link talks about various scenarios but not that one so I'm not sure if this means Peter and I need to be concerned. I saw similar results

RE: Preparing for upcoming DNSSEC changes on 5/5

2010-05-03 Thread Lightner, Jeff
Feher Sent: Monday, May 03, 2010 4:10 PM To: bind-us...@isc.org Subject: Re: Preparing for upcoming DNSSEC changes on 5/5 On 3/05/10 9:54 PM, Lightner, Jeff jlight...@water.com wrote: On doing that however, I now see the advertised value is 3839 but the at least value is 3828 on one and 3827

RE: Preparing for upcoming DNSSEC changes on 5/5

2010-05-03 Thread Lightner, Jeff
for upcoming DNSSEC changes on 5/5 On 3/05/10 7:34 PM, Lightner, Jeff jlight...@water.com wrote: There is no EDNS entry in my named.conf. Do I need one, given that above worked? You probably should. Your resolver is saying its capable of handling 4096, but apparently your network path may

RE: Preparing for upcoming DNSSEC changes on 5/5

2010-05-03 Thread Lightner, Jeff
I was using the Java tester on a Windows system and saw the same 4096/3843 as I'd seen with DIG and just now noticed this comment in its results: Note: There will always be a difference between the announced and measured buffer size because of the algorithm used. However this difference should

RE: Preparing for upcoming DNSSEC changes on 5/5

2010-05-04 Thread Lightner, Jeff
The point in my anecdote and the quote from the test was to say that you do NOT need to set the value if you're getting something within 300 bytes of the advertised value. You are as I was so do not need to set it. It may be the person that suggested setting it was under the misapprehension

RE: Preparing for upcoming DNSSEC changes on 5/5

2010-05-05 Thread Lightner, Jeff
8:30 EDT 05/05/2010 and the world hasn't ended here yet. We can celebrate Cinco de Mayo in peace. If only I didn't detest tequila. Side note: I've actually been to Puebla Mexico which is where the battle that Cinco de Mayo commemorates took place. -Original Message- From:

RE: ftp.isc.org back up

2010-05-06 Thread Lightner, Jeff
They can't fool us - we know it was caused by the J server DNSSEC issue. :-) -Original Message- From: bind-users-bounces+jlightner=water@lists.isc.org [mailto:bind-users-bounces+jlightner=water@lists.isc.org] On Behalf Of Jack Tavares Sent: Thursday, May 06, 2010 2:17 PM To:

RE: disable dnssec in bind resolver

2010-06-04 Thread Lightner, Jeff
I don't understand that. Are you saying that dnsec-validation no; is in your named.conf or are you saying you don't believe it is necessary to set it there because by default validation is off? If the latter what does it hurt to try it? Obviously something isn't working the way you expect or

RE: Microsoft's nslookup Implementation Problems

2010-06-14 Thread Lightner, Jeff
Hah! Convincing PHBs that a mature OS like Windows is broken as compared to that weird UNIX/Linux stuff is like convincing the Amish that horse drawn plows aren't the best way to improve crop yields. You're fighting a religious battle in both cases. -Original Message- From:

RE: the one A record that must be in a Zone

2010-06-15 Thread Lightner, Jeff
Do they all actually use separate IPs? Here we have multiple domains that all go to the same web server many of which are going to the same NATed IP. For those we just create a zone (e.g. okstate-aliases) with standard setup and then the A record we have is for @ like: @ IN SOA

RE: Running both a cache-only and an authoritative server on thesame server

2010-06-17 Thread Lightner, Jeff
No but you set notify-source and transfer-source to the IP of the NIC that you want to handle the view. That effectively restricts the traffic for that view to the specific NIC. (Note this is the NIC's internal IP not any NAT ip you might have redirected to that internal IP.) -Original

RE: out of memory Errors

2010-06-18 Thread Lightner, Jeff
This is to say the limitation is the 32 bit not the Solaris. You have the same limit in HP-UX 32 bit, Linux 32 bit etc... -Original Message- From: bind-users-bounces+jlightner=water@lists.isc.org [mailto:bind-users-bounces+jlightner=water@lists.isc.org] On Behalf Of Stacey

RE: Script-kiddie / client IP query (cache) 'host/MX/IN' denied

2010-08-03 Thread Lightner, Jeff
Blackhole isn't better IMHO because I found in the past that they still try your server ad nauseum even though they're blocked - blocking at iptables is doing it at kernel level before BIND. However it does work and is certainly one way to do it especially on systems that don't have their own

RE: Script-kiddie / client IP query (cache) 'host/MX/IN' denied

2010-08-03 Thread Lightner, Jeff
Yes - I had already written him off list in reply to an email he sent me and pointed it out. It also only blocks port 53 so if he had other ports open the script kiddie would still be able to see those other ports. -Original Message- From:

RE: Script-kiddie / client IP query (cache) 'host/MX/IN' denied

2010-08-03 Thread Lightner, Jeff
2 rules aren't needed if you don't specify protocol and port in the first one. It simply drops ALL traffic from that IP. -Original Message- From: bind-users-bounces+jlightner=water@lists.isc.org [mailto:bind-users-bounces+jlightner=water@lists.isc.org] On Behalf Of Lyle Giese

RE: www.ncbi.nlm.nih.gov / pubmed

2010-08-18 Thread Lightner, Jeff
It comes right up in Firefox but prompts for a username and password. Dig shows: dig www.ncbi.nlm.nih.gov ; DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_4.2 www.ncbi.nlm.nih.gov ;; global options: printcmd ;; Got answer: ;; -HEADER- opcode: QUERY, status: NOERROR, id: 22983 ;; flags: qr rd ra; QUERY:

RE: I get No mail exchanger (MX) records available for rimm.com errorjust for a couple of domains

2010-08-19 Thread Lightner, Jeff
What is so obvious about it not being down? If folks like ATT and other major corporations could have outages I don't see any reason why this one couldn't. Note that you typed rimm.com (two m's) not rim.com. The former has a red WOT rating so I suspect it is used to spoof the latter but

RE: Verizon Users Can't See Site

2010-09-14 Thread Lightner, Jeff
From our ATT based network it works but the individual server digs (dns1 dns2) were significantly slower than the dig in which I didn't specify a server. $ dig @dns2.mbc.irides.com www-mbclive.mbc.irides.com ; DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_4.2 @dns2.mbc.irides.com

RE: All zone blocks for public view should be listed here in internaltoo!

2010-09-23 Thread Lightner, Jeff
In views order is important. If you have internal before others (e.g. external) then that is the default view. What I *think* it is telling you is that if you have an internal view that you restrict to certain networks that you need to insure you have all the public zones in the

RE: repository for zone files

2010-09-23 Thread Lightner, Jeff
/etc = named.conf, rndc.conf and other config files /var/named = zone files. Are you running just bind or bind-chroot. If the latter then named.conf goes in /var/named/chroot/etc rather than /etc and the zone files go into /var/named/chroot/var/named instead of /var/named. You can configure

RE: repository for zone files

2010-09-24 Thread Lightner, Jeff
No the prior poster was correct - you can do chroot or SELinux or both. While it is true that RedHat teaches SELinux and ships it you can always disable it if you prefer not to use it. You are asked during the install of the OS and you can disable it or enable it any time you want after the

RE: repository for zone files

2010-09-24 Thread Lightner, Jeff
Up until Bill came out with NT with the stated intention of killing UNIX I was somewhat of an M$ fan (over Apple that is). All he really succeeded in killing was Netware. Now years later Apple is running a UNIX based OS - go figure. -Original Message- From:

RE: repository for zone files

2010-09-24 Thread Lightner, Jeff
And of course VMWare is 80% owned by EMC: http://www.boston.com/business/technology/articles/2010/03/03/emc_to_maintain_80_vmware_stake/ -Original Message- From: Dale Kiefling [mailto:dale.kiefl...@cbsinteractive.com] Sent: Friday, September 24, 2010 1:46 PM To: Lightner, Jeff Cc

RE: Unable to query the nameserver

2010-10-06 Thread Lightner, Jeff
Of course some versions of nslookup arent' standard even for nslookup. The one on HP-UX actually interrogates local /etc/hosts file if nsswitch.conf says to use files first. I got so used to doing that for years that when I tried to use nslookup on Linux back in 2005 I was miffed because it was

RE: named-checkzone Test Runs

2010-10-13 Thread Lightner, Jeff
Can you share what you're talking about since it appears you're saying you got the reply off list? -Original Message- From: bind-users-bounces+jlightner=water@lists.isc.org [mailto:bind-users-bounces+jlightner=water@lists.isc.org] On Behalf Of Martin McCormick Sent: Wednesday,

RE: No cache for NS RR in public DNS

2010-10-15 Thread Lightner, Jeff
You're saying its getting the records because they are cached at org? -Original Message- From: bind-users-bounces+jlightner=water@lists.isc.org [mailto:bind-users-bounces+jlightner=water@lists.isc.org] On Behalf Of Mark Andrews Sent: Friday, October 15, 2010 9:21 AM To: Tech W.

RE: limiting number of recursion/queries per IP address

2010-10-26 Thread Lightner, Jeff
iptables is available in most Linux distros and it is definitely better to block things there than in BIND itself. I don't know that BIND has a rate limiter. It DOES have a blacklist option where you can completely block a site's access to it but as noted above it is better to do it in iptables

RE: DNSSEC and Bind 9.3.6

2010-11-03 Thread Lightner, Jeff
Some OSes provide an official BIND package and maintain it. (e.g. RHEL 5.x uses BIND 9.3.x). This package while initially based on 9.3 from ISC may have security and/or functionality updates backported into it from later versions of BIND. If you are using such an official package from your OS

RE: no. of Views and Zones

2010-11-08 Thread Lightner, Jeff
You would NOT use a single zone for this. Views are designed specifically to control what is seen. However, that control is mainly done by acl's specifying which networks access which views. Do you assign specific subnets to each client? If so you could do this with views but processing

RE: no. of Views and Zones

2010-11-08 Thread Lightner, Jeff
was concerned about security of each customer. This would especially be true if those customers also had web, mail or other servers being hosted by me as well. -Original Message- From: Chris Buxton [mailto:chris.p.bux...@gmail.com] Sent: Monday, November 08, 2010 12:32 PM To: Lightner, Jeff Cc

Rules against links or certain links?

2010-11-11 Thread Lightner, Jeff
I've noticed a couple of times on this list that if I post links for certain on line sites with free tools like whois that they never seem to make it to the list. Is there some prohibition against posting those links that would cause them to be filtered out? I know at least one of them also

RE: Rules against links or certain links?

2010-11-11 Thread Lightner, Jeff
D'oh - I realize now that the reply ONLY went to you and not to the list. Trying to send it to list with this reply. -Original Message- From: Lightner, Jeff Sent: Thursday, November 11, 2010 9:21 AM To: 'Torsten' Subject: RE: Rules against links or certain links? Yes. I think you

RE: DNSSEC with 9.7.2-P2

2010-11-12 Thread Lightner, Jeff
Not a hole if you look at the reasoning for Fedora itself. It has a short lifecycle and they expressly tell folks not to use it for Production due to this. It is meant to be bleeding edge for testing the latest/greatest. It is used as a test bed for what makes it into RHEL. For Production

RE: get a domain's dns records

2011-01-21 Thread Lightner, Jeff
It checks for test.domain - I saw it do that for my zone. For us it isn't a subdomain but simply an A record. Apparently when it found your record it went ahead and did another check for your sub-zone. I'm surprised that it does not check for ftp.zone. Whenever we're doing acquisitions here

RE: about the file command

2011-02-08 Thread Lightner, Jeff
BIND doesn't require you to use any views by default. The way views work one of them IS a default so order of views is important. You would use the default as your catch all. -Original Message- From: bind-users-bounces+jlightner=water@lists.isc.org

RE: Please Help

2011-02-17 Thread Lightner, Jeff
IIRC the U.S. Government last year or the year before mandated all their sites be DNSSEC compliant by early this year. Maybe it is just a sign they are actually doing it. -Original Message- From: bind-users-bounces+jlightner=water@lists.isc.org

RE: Slaves and views

2011-03-04 Thread Lightner, Jeff
Haven't done it but don't see why not. Since every entry in named.conf specifies the zone file you can definitely have multiple zones all pointing to the same zone file. (We do that for many ancillary zones that we want to point to our primary domain so have an aliases file that uses the @

RE: R: Operating system recommendation

2011-03-11 Thread Lightner, Jeff
Linux people and their reinstalls?! Somebody has confused Linux with Windows. We've been running RedHat Eneterprise Linux (RHEL) systems commercially for several years (including our DNS servers) and the only time I reinstall is when I'm redeploying a system and/or want to go to a newer major

RE: R: Operating system recommendation

2011-03-11 Thread Lightner, Jeff
but always knew I wasn't the tail that wags the dog. You apparently think you are in your organization so congrats on that. -Original Message- From: Dan [mailto:d...@sunsaturn.com] Sent: Friday, March 11, 2011 12:33 PM To: Lightner, Jeff Cc: bind-users@lists.isc.org Subject: RE: R

RE: RHEL5 BIND in PROD

2011-03-15 Thread Lightner, Jeff
If these are new servers that are only for BIND I'd suggest going with RHEL6 rather than 5.6 - RHEL releases have very long life cycle. When I get a spare moment I intend to update our servers to RHEL6. We use the RHEL5 BIND package for the reasons you give. However, the way RedHat does things

RE: dns RR method is not equal balanced?

2011-03-29 Thread Lightner, Jeff
Not to mention that RedHat just announced pending EOL of RHEL4 last week. RHEL5 has been out since around 2007 and RHEL6 was released around the start of this year. From: bind-users-bounces+jlightner=water@lists.isc.org

RE: children whose zones do not reflect the delegation from the parent

2011-03-30 Thread Lightner, Jeff
I'm wondering if the issue isn't because you've not told your ISP what your name servers are. You have to do that for reverse delegations to get to your servers. (This is in addition to telling your Registrar.) -Original Message- From:

RE: Migrate domains to different DNS servers

2011-04-20 Thread Lightner, Jeff
By re-delegate do you mean at the Registrars and ISPs? If so and if you have more than one DNS server for redundancy (as you should) then you can replace one server at a time using the same name/IP on the new server as on the old server. When we did this a few years back we simply moved the

Getting different name resolution for news.google.com from master and slave BIND

2011-05-24 Thread Lightner, Jeff
Is anyone else seeing odd results with news.google.com? My BIND 9 master and slave are getting different results. If I go out to other sites such as Kloth.net or iptools.com they also get different results from each other and different from what my master and slave are reporting. I'm

RE: Getting different name resolution for news.google.com from master and slave BIND

2011-05-24 Thread Lightner, Jeff
they are not in different locations or in a separate subnet is why I don't understand why I'd be getting separate location specific IPs handed to the two servers. -Original Message- From: Warren Kumari [mailto:war...@kumari.net] Sent: Tuesday, May 24, 2011 4:06 PM To: Lightner, Jeff Cc: bind-users

RE: DNS attacking

2011-05-25 Thread Lightner, Jeff
You can blacklist things in named.conf but we've found it more efficient to simply have iptables drop packets from the offending IPs so they never even get to BIND. -Original Message- From: bind-users-bounces+jlightner=water@lists.isc.org

RE: Getting different name resolution for news.google.com from masterand slave BIND

2011-05-25 Thread Lightner, Jeff
Subject: RE: Getting different name resolution for news.google.com from masterand slave BIND Lightner, Jeff wrote: The master is dswadns1.water.com at 12.44.84.213 and the slave is dswadns2.water.com at 12.44.84.214. So, they leave your network in the same way, through the same router etc

RE: bind restart needed to reflect changes to dynamic zone in multipleviews

2011-06-24 Thread Lightner, Jeff
I wonder if pointing to different file names with one being a symbolic link to the other would work? That way you'd only have to create and update the one file but the transfer would transfer two separate files. -Original Message- From: bind-users-bounces+jlightner=water@lists.isc.org

RE: better performance with 32 bit ! why?

2011-06-29 Thread Lightner, Jeff
I'm not sure I agree with that - multiple single threaded processes can be distributed across cores/CPUs. That is to say ONE single thread process doesn't gain from multiple cores but more than one can because they don't have to compete against each other on the same core. -Original

RE: RFC 6303 and automatic empty zones

2011-07-14 Thread Lightner, Jeff
Expecting the future - Planning your life around it is something sales folks like to do and most of the rest of us call vaporware - it's always going to be available the 2nd quarter of next year. -Original Message- From: bind-users-bounces+jlightner=water@lists.isc.org

RE: about the dig

2011-07-19 Thread Lightner, Jeff
Or as previously pointed out it WILL work if you specify a name server at invocation. That is to say you MUST either do dig @server... OR have a resolve.conf that specifies servers to attempt if not specified at invocation. (And before anyone else says it - You can of course still specify a

RE: no servers could be reached

2011-07-28 Thread Lightner, Jeff
Also has a wrong name: Should be resolv.conf NOT resolve.conf. -Original Message- From: bind-users-bounces+jlightner=water@lists.isc.org [mailto:bind-users-bounces+jlightner=water@lists.isc.org] On Behalf Of Michael McNally Sent: Thursday, July 28, 2011 3:47 PM To:

RE: syntax error in $GENERATE crashed all nameservers

2011-08-18 Thread Lightner, Jeff
input for this command? Please don't respond that negative numbers are integers and therefore valid - that would be pure sophistry.) -Original Message- From: Warren Kumari [mailto:war...@kumari.net] Sent: Thursday, August 18, 2011 1:26 PM To: Lightner, Jeff Cc: bind-users@lists.isc.org

Delegation check failed

2011-09-20 Thread Lightner, Jeff
Can someone give me a better explanation of why this is saying my delegation failed than the FAQ does? In a separate thread I saw this recommendation to another user: I think the checking tool at http://dnscheck.iis.se/?test=undelegated may be what you need. You may find it

RE: Delegation check failed

2011-09-20 Thread Lightner, Jeff
message is trying to tell me. -Original Message- From: Matthew Seaman [mailto:m.sea...@infracaninophile.co.uk] Sent: Tuesday, September 20, 2011 11:52 AM To: Lightner, Jeff Cc: bind-users@lists.isc.org Subject: Re: Delegation check failed On 20/09/2011 14:25, Lightner, Jeff wrote

RE: Delegation check failed

2011-09-21 Thread Lightner, Jeff
I think it is safe to say the issue is the iis.se site is broken so far as delegation test goes. Another user reported to me that he had several domains return the same thing at this site. Thanks everyone for the replies. -Original Message- From:

RE: Delegation check failed

2011-09-21 Thread Lightner, Jeff
I was the one asking about water.com. I'd started a separate thread hoping not to tromp on the OP of the earlier thread but apparently didn't succeed. I know the reason for the SOA/MX report so never asked about that. I did ask about the delegation messages but at this point as noted earlier

RE: One IP in multiple zones

2011-09-21 Thread Lightner, Jeff
One thing we do is create a single alias zone with generic information in it to have multiple zones all go to the same IP. Typically the main zone we'll put in its own zone file and have named.conf associate that zone with that zone file. For other zones we tell named.conf to point to the

RE: CNAME or A record?

2011-09-28 Thread Lightner, Jeff
If you set your SOA properly to use @ (which means this zone) your A records should be: domain.com. A 1.1.1.1 www A 1.1.1.1 The SOA should append the domain.com to every record not terminated by a dot so that www is read as www.domain.com. Similarly

RE: CNAME or A record?

2011-09-28 Thread Lightner, Jeff
+1 All of our redirects are either done by rewrite rules in Apache or Jboss or on our load balancer. We don’t do any in DNS. From: bind-users-bounces+jlightner=water@lists.isc.org [mailto:bind-users-bounces+jlightner=water@lists.isc.org] On

RE: CNAME or A record?

2011-09-28 Thread Lightner, Jeff
: bind-us...@isc.org; bind-users@lists.isc.org; Lightner, Jeff Subject: Re: CNAME or A record? Either is fine. Using the cname would require a single update if your ip changes, but prevents other records at the same level. So you couldn't attach mx for instance at example.comhttp://example.com

RE: CNAME or A record?

2011-09-29 Thread Lightner, Jeff
and that my preference was A records. -Original Message- From: bind-users-bounces+jlightner=water@lists.isc.org [mailto:bind-users-bounces+jlightner=water@lists.isc.org] On Behalf Of wbr...@e1b.org Sent: Wednesday, September 28, 2011 7:17 PM To: Lightner, Jeff Cc: bind-us...@isc.org

RE: resolv record without domain

2011-09-29 Thread Lightner, Jeff
Right - the issue here is the lookup not the DNS record itself. On UNIX/Linux hosts the file is /etc/resolv.conf. However, I do see a DNS configuration issue here as well. There should NOT be a dot after name in the A record - that tells it NOT to append the domain name. -Original

RE: Master and slave on same host

2011-10-11 Thread Lightner, Jeff
What do you mean you can’t have additional IPs? Even if you don’t have other network connections you can use virtual IPs on a single NIC. I have one server (not DNS) that has 30 virtual IPs on a single NIC. From:

RE: host versus nslookup

2011-10-12 Thread Lightner, Jeff
One thing that is different about nslookup on HP-UX (which doesn't have host) is that it actually respects nsswitch.conf so will give you results from /etc/hosts OR from name services whereas most implementations only do it from name services. Nslookup is deprecated meaning you should use host

RE: host versus nslookup

2011-10-12 Thread Lightner, Jeff
So hitting yourself in the head with a shovel is better? :p -Original Message- From: bind-users-bounces+jlightner=water@lists.isc.org [mailto:bind-users-bounces+jlightner=water@lists.isc.org] On Behalf Of David Miller Sent: Wednesday, October 12, 2011 4:08 PM To:

RE: DNS Sinkhole in BIND

2011-10-17 Thread Lightner, Jeff
While setting up blackholes in BIND works fine when I did this on Linux I found that setting up iptables to do drops for known bad IPs/ranges was slightly better as the traffic never gets to BIND in the first place as it is stopped at kernel level. It simply DROPs the packet without telling

RE: DNS Sinkhole in BIND

2011-10-17 Thread Lightner, Jeff
I’m confused – does the OP want to block or does he want to redirect. “block/redirect” are two different things. What I wrote will block. If he wants to redirect that’s fine but I don’t think he’d want to redirect to his real webserver – why send bogus traffic there and also take the risk

RE: DNS Sinkhole in BIND

2011-10-27 Thread Lightner, Jeff
it. -Original Message- From: bind-users-bounces+jlightner=water@lists.isc.org [mailto:bind-users-bounces+jlightner=water@lists.isc.org] On Behalf Of Michelle Konzack Sent: Wednesday, October 26, 2011 9:01 PM To: bind-users@lists.isc.org Subject: Re: DNS Sinkhole in BIND Hello Lightner, Jeff

RE: Question About max-clients-per-query

2011-11-18 Thread Lightner, Jeff
Not an answer to your basic question but I did want to mention that on most UNIX/Linux terminal sessions you can hit Ctrl-s to stop scrolling and Ctrl-q to resume it. -Original Message- From: bind-users-bounces+jlightner=water@lists.isc.org

RE: Bind 9.9.0b2 inline signing...

2011-11-28 Thread Lightner, Jeff
You can install Cygwin under Windoze and then get most Linux packages under that. Alternatively you can just install the Windows zip file for BIND and use the dig.exe it provides. -Original Message- From: bind-users-bounces+jlightner=water@lists.isc.org

RE: bind 9.2.1 assertion failure

2011-12-07 Thread Lightner, Jeff
ISC who makes bind doesn't support it any longer. Mark is with ISC. What do you have this installed on? It may be something distro specific and if so you may need to get you question answered by whoever provided it to you. For example RedHat Enterprise Linux distributes a modified version of

CNAME only zone?

2011-12-09 Thread Lightner, Jeff
Is it possible to create a zone file that only contains a CNAME? The request I got is to create a CNAME to point shop4water.com to shop4water.hostedbywebtstore.com. We own shop4water.com – hostedbywebstore.com is something external that we don’t own. I’ve reviewed past posts and searched the

RE: CNAME only zone?

2011-12-09 Thread Lightner, Jeff
: Re: CNAME only zone? On 09/12/11 16:25, Lightner, Jeff wrote: Is it possible to create a zone file that only contains a CNAME? This comes up a lot, it seems. No. CNAME conflicts with any other record - including the SOA and NS records required at the apex. You will have to put an A record

RE: CNAME only zone?

2011-12-09 Thread Lightner, Jeff
@lists.isc.org] On Behalf Of /dev/rob0 Sent: Friday, December 09, 2011 12:41 PM To: bind-users@lists.isc.org Subject: Re: CNAME only zone? On Friday 09 December 2011 10:25:36 Lightner, Jeff wrote: Is it possible to create a zone file that only contains a CNAME? As already answered

RE: .TLD minimum number of nameservers rule

2011-12-12 Thread Lightner, Jeff
Or you could simply put a virtual IP address on the same name server (and any NATting required) and put it in as your second at the registrar. That is to say the Registrar would see the same name server with two different names and IPs so wouldn't know it was the same name server.

RE: About root zones

2011-12-21 Thread Lightner, Jeff
if a root zone is not defined in named.conf I wonder if you really do NOT want to ever hit root zones you could make your own entry in named.conf that points to localhost for root zone and thereby avoid hitting any real root? -Original Message- From:

  1   2   >