About an hour and a half ago, I see good AXFRs in the logs:
May 02 16:27:31 sa-vm1 pdns_server[14404]: May 02 16:27:31 AXFR of
domain 'spamassassin.org' initiated by 209.237.226.92
May 02 16:27:31 sa-vm1 pdns_server[14404]: May 02 16:27:31 AXFR of
domain 'spamassassin.org' allowed: client IP 209.237.226.92 is in
allow-axfr-ips
May 02 16:27:31 sa-vm1 pdns_server[14404]: May 02 16:27:31 AXFR of
domain 'spamassassin.org' to 209.237.226.92 finished
May 02 16:28:07 sa-vm1 pdns_server[14404]: May 02 16:28:07 AXFR of
domain 'spamassassin.org' initiated by 209.237.226.92
May 02 16:28:07 sa-vm1 pdns_server[14404]: May 02 16:28:07 AXFR of
domain 'spamassassin.org' allowed: client IP 209.237.226.92 is in
allow-axfr-ips
May 02 16:28:07 sa-vm1 pdns_server[14404]: May 02 16:28:07 AXFR of
domain 'spamassassin.org' to 209.237.226.92 finished
But I still see the old serial:
$ dig +short @ns.hyperreal.org spamassassin.org soa
ns.hyperreal.org. pmc.spamassassin.apache.org. 2017031501 86400 3600
2678400 3600
Maybe those were test AXFRs but they seemed to work based the logs.
Dave
On 05/02/2017 11:27 AM, Kevin A. McGrail wrote:
Dave, thoughts re: Hyperreal below?
Hrm, I seem to be getting a block. My usual tool for this is djbdns, and
I pull down secondaries using tcpclient, as so:
[root@taz4 /etc/tinydns/root/secondaries]# /usr/local/bin/tcpclient
62.210.60.231 53 /usr/local/bin/axfr-get spamassassin.org
spamassassin.org foo.tmp
axfr-get: fatal: unable to parse AXFR results: protocol error
Any ideas? I'm coming either from 209.237.226.90 or .92, not sure which
would be default but I think .92.
Brian
On Tue, 2 May 2017, Kevin A. McGrail wrote:
Gents, I appreciate your patience and I'm cc'ing a new list for SA
sysadmins
so there can be better documentation with a higher bus factor. If you
are ok
with your emails being known, that would be cool if you replied back
to the
list.
Please point your public slaves at 62.210.60.231 as their master,
allowing
notifies/transfers/beers to flow freely.
Grant, can you confirm which IPs we should notify? We have some
discrepancies
but perhaps you had some slaving internally occurring however there were
small discrepancies on the records.
Brian, we'll check when you turn things back on but it appears you were
missing a test DKIM record oddly enough. Perhaps a record length
limit or
something.
Best,
KAM
