- dns-wg - mailman.ripe.net

Re: views in bind9
by Jim Reid 29 Apr '03

29 Apr '03

Mansoor, your question would probably be better posted to bind9-users(a)isc.org, rather than this mailing list. dns-wg(a)ripe.net is for stuff related to the RIPE DNS Working Group and doesn't usually deal with errors or misunderstandings about named.conf files. If you do post to bind-users, I strongly suggest you provide your named.conf file *exactly* as your name server would see it. [Don't hide domain names or whatever.] That would permit someone on that list to accurately diagnose the problem. My guess is you have syntax errors in named.conf or perhaps you're running a BIND8 name server with a BIND9 configuration file. If it's the former, you can use named-checkconf from BIND9 to find the error. A sample named.conf file which uses views can be found under the tests directory in the BIND9 distribution. This directory contains a test suite for most of the features in BIND9. Here's an outline of how to set up views in BIND9, with an inside view for network 10/8 and an outside view for everything else. options { ...... }; controls { ...... }; view "inside" { match-clients { 10/8; }; zone "." { ....... }; zone "example" { ..... }; }; view "outside" { match-clients { !10/8; }; zone "." { ....... }; zone "example" { ..... }; }; If you have further questions about BIND9 config file syntax, please take them to bind9-users(a)isc.org, not here. And please don't ask me directly. :-)

1 0

32.48.194.in-addr.arpa to 63.48.194.in-addr.arpa
by UTA HostMaster 31 Mar '03

31 Mar '03

hello there seems to be problem with the dns-entries for 32.48.194.in-addr.arpa to 63.48.194.in-addr.arpa. the entries in the RIPE-db have the correct dns (dns1.uta.at / ns1.ooe.gv.at). but the entries in ns.ripe.net show ns1.ooe.gv.at and ns.ooe.gv.at. is there a possibility to correct this without sending the reverse delegations again to auto-inaddr(a)ripe.net? > 63.48.194.in-addr.arpa Server: ns1.ooe.gv.at Address: 194.48.60.9 63.48.194.in-addr.arpa origin = ns1.ooe.gv.at mail addr = domain-admin.ooe.gv.at serial = 2001011600 refresh = 86400 (1D) retry = 7200 (2H) expire = 604800 (1W) minimum ttl = 3600 (1H) 63.48.194.in-addr.arpa nameserver = dns1.uta.at 63.48.194.in-addr.arpa nameserver = ns1.ooe.gv.at ns1.ooe.gv.at internet address = 194.48.60.9 > server ns.ripe.net Default Server: ns.ripe.net Address: 193.0.0.193 > set type=any > 63.48.194.in-addr.arpa Server: ns.ripe.net Address: 193.0.0.193 Authoritative answers can be found from: 63.48.194.in-addr.arpa nameserver = ns1.ooe.gv.at 63.48.194.in-addr.arpa nameserver = ns.ooe.gv.at with best regards ------------------------------------------------------- Peter Steinkellner Engineering & Operations Services UTA Hostmaster UTA Telekom AG Donau-City-Strasse 11 A-1220 Wien T: +43/1/9009-4130 F: +43/1/9009-3967 M: +43/699/1388-4130 mailto:peter.steinkellner@uta.at http://www.uta.at -------------------------------------------------------

2 1

Upgrade of 'NCC.RIPE.NET' - 2003-03-21 13:30-14:00 UTC
by Bruce Campbell 20 Mar '03

20 Mar '03

The RIPE NCC is upgrading a portion of the Hostcount project, 'NCC.RIPE.NET', between 13:30 and 14:00 (UTC) on the 21st of March, 2003 by replacing the hardware with a new machine. Sessions to this machine (updates of hostcount data) will be interrupted during this time. Kind regards, -- Bruce Campbell RIPE Systems/Network Engineer NCC www.ripe.net - PGP562C8B1B Operations/Security

1 0

Slot request for next RIPE Meting: ZoneCheck Tool from French NIC
by Mohsen Souissi 19 Mar '03

19 Mar '03

Hi Jim & Peter, As I told Jim this afternoon, AFNIC would like to present to the DNS community the new version of our ZoneCheck tool (ZoneCheckv2) which allows DNS zone checking with respect to DNS standards. Stephane D'Alu (address Cc'ed) wrote the new version from scratch. It fully supports IPv6 and open to support new technologies such as DNSsec and IDN. Here is the URL of a non-definitive version of our ZoneCheck tool : http://zonecheck.nic.fr/v2/ Should you need any further information, please send an e-mail to Stephane and/or zonecheck(a)nic.fr Thanks beforehand, Mohsen.

1 0

ISC OpenReg 1.0.1 Release
by Joe Abley 17 Mar '03

17 Mar '03

[this message is being copied to multiple mailing lists; apologies in advance for duplicates] The Internet Software Consortium is pleased to announce the first public release of OpenReg, an implementation of a DNS Shared Registry System which supports the Extensible Provisioning Protocol (EPP). For more information, and to download OpenReg, please see: http://www.isc.org/products/OpenReg/ OpenReg is free software, released under a BSD-style licence.

1 0

Upgrade of 'DNS.RIPE.NET' 2003-03-13 13:30-14:00 UTC
by Bruce Campbell 12 Mar '03

12 Mar '03

The RIPE NCC is upgrading its primary nameserver, 'DNS.RIPE.NET', between 13:30 and 14:00 (UTC) on the 13th of March, 2003 by replacing the hardware with a new machine. There will be a short period (on the order of 30 seconds) when queries will not be answered. Most resolvers will simply retry or try another nameserver when this occurs. There is also a small window (on the order of two minutes) where some zones secondaried by 'DNS.RIPE.NET' may appear to go backwards to a previous version (although we will attempt to ensure that all zones are up to date before changing over). This situation will correct itself within a short period of time. For any further questions on the upgrade of this machine, please contact ops(a)ripe.net . Kind regards, -- Bruce Campbell RIPE Systems/Network Engineer NCC www.ripe.net - PGP562C8B1B Operations/Security

1 0

RIPE NCC network affected by the DDoS attack
by Andrei Robachevsky 27 Feb '03

27 Feb '03

Dear Colleagues, Starting from 14:00 UTC today, 27 February, RIPE NCC network suffered a large DDoS attack. It was a distributed ICMP echo attack. The attack caused various congestion related problems for the RIPE NCC's network, to the extent that our BGP peering sessions were affected, and non-ICMP traffic was being randomly dropped. The attack was successfully mitigated with cooperation of our peer networks at AMS-IX. Network condition returned back to normal at 16:30 UTC. As a result some of our services, including www.ripe.net (web), whois.ripe.net (RIPE Database), ns.ripe.net (DNS) and ftp.ripe.net (FTP) were not accessible during this timeframe. Now all services are back to normal. Regards, Andrei Robachevsky CTO, RIPE NCC

1 0

Re: clueing in TLD registries for delegations to non-BIND servers
by Jim Reid 24 Feb '03

24 Feb '03

>>>>> "Stefan" == Stefan Paletta <stefanp(a)cabal1.com> writes: Stefan> All, good to see nsd make progress (played with it a litte Stefan> while ago, but tinydns continues to serve me best). Oh dear. It seems that the behaviour of tinydns is preventing you from registering domains in some TLDs. That wouldn't appear to be "serving you best", at least not to me anyway. Stefan> Some TLD registries, however, make unreasonable demands Stefan> regarding the behaviour of servers to which they delegate Stefan> zones. Most notably the .fr and .it registries, which Stefan> apparently demand that servers return a Stefan> (non-authoritative!, in the case of .it) referral to the Stefan> root servers when they are lame. These demands are highly Stefan> questionable -to say the least- and are hard and sometimes Stefan> impossible to follow for users of at least tinydns and Stefan> nsd. While I am not speaking on behalf of these registries -- they can do that themselves -- I believe they're acting out of enlightened self-interest. Many people think a registration entitles them to hours of free consultancy from the registry on how to set up and configure their name servers. [I have been in several registries and overheard the helpdesk staff answer floods of these calls.] Expecting a customer to have name servers that answer authoritatively and/or know about the root servers goes a long way to reducing the number of these misdirected requests for help. "Don't come to us until your name servers are working" is not an unreasonable stance IMO. Stefan> I was wondering if RIPE or a group from the RIPE community Stefan> might appeal to those registries and try to make them stop Stefan> acting stupid. First or all, you do not do your cause any good by spreading insults. This is not constructive or helpful. Secondly, you should be aware that it's not for RIPE or the DNS WG to dictate policy to a ccTLD registry -- that's a national matter -- or tell anyone how to run their name servers. How an organisation chooses to operate its infrastructure is up to them. The WG can produce recommendations or a best common practice (eg RIPE-192) but that's it. People are free to accept or reject or ignore that advice as they see fit. If you wish to prepare such a recommendation, go ahead. The matter can be discussed on this list and I'll be happy to arrange discussion time for the subject at future sessions of the WG. As WG chair, I would welcome a wider analysis of the registration policies of the TLD registries in the RIPE region (and beyond?) and try to see if some common guidelines can be established. This could be a worthwhile subject for a WG recommendation. The topic has exercised you, so I think you'd be an ideal candidate to get that work under way. :-) And if I can be provocative, why don't you ask the author of djbdns to make the software do the Right Thing and at least *respond* whenever it gets a query for something it's not authoritative for?

5 6

My video from RIPE 44...
by Brad Knowles 20 Feb '03

20 Feb '03

Folks, For anyone who is interested, I've got a few files moved up to <http://www.shub-internet.org/brad/pictures/RIPE44>. I'll be moving the rest up fairly soon. If I need to reclaim space and get back down below my quota, I may have to take them down again, but hopefully everyone who wants them will have copied them off by then. I'd welcome any feedback you may have. Thanks! -- Brad Knowles, <brad.knowles(a)skynet.be> "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++)

1 0

k.root-servers.net Changing DNS Software at on 19.2.2003
by Daniel Diaz 19 Feb '03

19 Feb '03

Dear all, We are glad to announce that k.root-servers.net has successfully started to run NSD with the change over being completed at 9:25 a.m. UTC. Best regards. -- Daniel.Diaz & Bruce Campbell Operations RIPE NCC

1 0