Thought I'd mention that I helped setup BIND 9.2.3rc3 on a yellowdog
linux powercomputing machine tonight. It worked. And the mail queues
began clearing out. Just for an oddball success report.
Are others having similar luck? What needs to be done to make this a
standard feature set? Is somebody working on an RFC?
Thought I'd mention that I helped setup BIND 9.2.3rc3 on a yellowdog
linux powercomputing machine tonight. It worked. And the mail queues
began clearing out. Just for an oddball success report.
oh hell. thanks for the kind words, but we just released rc4.
Are others having similar luck? What needs to be done to make this a
standard feature set? Is somebody working on an RFC?
i do not expect the ietf to say that root and tld zones should all be
delegation-only. but good luck trying.
I am using bind 9.2.2-p2 on our resolver name servers so far.. And I have no
problems to report at this time, it's been running smooth so far; mail queues
started clearing out nice and clean.
-hc
We've been using these patches on production servers since they first
came out (both the 9.2.2 patches and the 9.2.3rcx versions); no problems
reported so far (knock wood).
Now all I need is a patched version of the 9.3 snapshot tree, so I don't need
to kill my dnssec stuff 
(And it's time for a non-snapshot bind version
with full dnssec capabilities anyway 
Paul
Paul Vixie wrote:
i do not expect the ietf to say that root and tld zones should all be
delegation-only. but good luck trying.
It hasn't been that large an issue in the past, and as pointed out by some, the countermeasures are just as harmful. I hope that delegation-only is only a temporary measure in bind. I'm sure some people will keep it running and probably put it on tld's where it'll break valid records.
-Jack
William Allen Simpson <wsimpson@greendragon.com> writes:
Thought I'd mention that I helped setup BIND 9.2.3rc3 on a yellowdog
linux powercomputing machine tonight. It worked.
It breaks a few things we care about--for example, www.ithaca.ny.us is
a naked CNAME in the the us root:
dsr_lnxcu9% dig @b.gtld.biz www.ithaca.ny.us
; <<>> DiG 9.2.1 <<>> @b.gtld.biz www.ithaca.ny.us
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38161
;; flags: qr rd; QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: 13
;; QUESTION SECTION:
;www.ithaca.ny.us. IN A
;; ANSWER SECTION:
www.ithaca.ny.us. 900 IN CNAME fallcrk.tc.cornell.edu.
;; AUTHORITY SECTION:
. 433340 IN NS J.ROOT-SERVERS.NET.
. 433340 IN NS K.ROOT-SERVERS.NET.
. 433340 IN NS L.ROOT-SERVERS.NET.
. 433340 IN NS M.ROOT-SERVERS.NET.
[...]
which is, IMO, more than a bit crazed, particularly considering that
ci.ithaca.ny.us is delegated, but there it is.
-dan
Dan Riley wrote:
It breaks a few things we care about--for example, www.ithaca.ny.us is
a naked CNAME in the the us root:
There's no reason to force .us as delegate only. Force com and net to delegate only and you'll have the Internet as it was before this debate started.
-Jack
I upgrade our DNS server the week-end but only to bind 9.2.2-P2. (And I
see there's a new release already. Sigh...) It's helped clear out a
bunch of mail queues.
I'm new to the list, but I do want to echo the thanks to Paul Vixie and
the ISC for their prompt work. Thanks You very much!