On 5/2/2017 10:01 AM, Dave Jones wrote:
I understand. I will have to see the normal cycle of things and
adjust when to run the DNS check script and he logic in the script.
Maybe it will need to exclude some records from the check that change
too frequently. My intention was to catch things like the test DKIM
TXT record that didn't exist at all.
If the slaves supported normal NOTIFY and zone transfers, then they
would always be identical to the hidden master.
...
If they are still running tinydns, then there are options to monitor
the log and perform the AXFR immediately to eliminate the lag which is
critical for healthy DNS hosting -- especially if there are frequent
updates to records.
Roger that, recommend you wait and see but wouldn't make too many
exclusions as too likely to break but agreed. Love the idea of a safety
check.
I do not believe the slaves support normal notify. Something in my
memory says that.
We can see after that but asking them to do a heavier lift like
monitoring logs, etc. is tough. The SA infrastructure can be quite the
attack vector for spammers so beggars can't be choosers.
Regards,
KAM
