Hi there,
I migrated our primary DNS from Bind to Knot. I runned some tests by
nic.cz's dnscheck, but there is an error:
DNSSEC signature RRSIG(fnhk.cz/IN/SOA/64431) fails to validate the RR set:
key 1: keytag does not match key 2:RSA Verification failed
Link to test:
http://dnscheck.labs.nic.cz/?time=1395821962&id=102810&view=advanced&test=s…
Knot doesn't complains to anything in the system log, fnhk.cz zone is
succefully signed.
What did I missed ?
Thanks and best regards
J.Karliak.
Hello,
What do you guys recommend to audit every resource
record in a zone file against all the records in all the DNS.
I want something that I feed the master zone file and then goes to each
NS server and ensures that the records are correct in all of them.
For some strange reason all my DNS servers have the same SOA Serial, but
after deleting two MX records, some 4 out of 5 the DNS servers have not
taken this update. I've yet to figure out the cause, but I see that SOA
Serial is not to be trusted.
Regards,
Maren.
On 2/24/2014 7:00 PM, knot-dns-users-request(a)lists.nic.cz wrote:
> Date: Mon, 24 Feb 2014 09:16:27 +0100
> From: Jan Kadlec <jan.kadlec(a)nic.cz>
> To: "Maren S. Leizaola" <leizaola(a)hk.com>
> Cc: knot-dns-users(a)lists.nic.cz
> Subject: Re: [knot-dns-users] GLUE and additional records.
> Message-ID:
> <1393229787.1717.12.camel(a)labs.jan.kadlec.ws.eth.1.office.nic.cz>
> Content-Type: text/plain; charset="UTF-8"
>
> Hello Maren and thanks for your report. Knot normally sends glue records
> in additional section, it seems as if you might have encountered a bug.
> Could you provide more data? One NS, A (AAAA) combination and a dig
> output for this combination should be enough. Thanks again, Jan.
>
The environment is as follows. I host hk.com on 6 DNS servers, right now
5 are bind and one is Knot. hk.com's name servers are
a,b,c,d,e,f.udrtld.net b is running Knot.
Try this link www.intodns.com/hk.com
This reports that B provides no glue. Please ignore the errors on f.
i've yet not setup urdtld.net on it.
dig -cA hk.com @b.udrtld.net
when I do a
dig -cA hk.com @a.udrtld.net
Am I making any mistakes here?
Maren.
Hello,
I am currently testing Knot on our zones and find that it
does not give any of the additional records which contain the IP of the
names servers ie knot servers donot provide Glue records. This is one
good thing that Bind does at it reduces the number of queries a resolver
has to make.
Is there any way for us to be able to do this.
Regards,
Maren.
Hi Everyone,
I think the time is ripe for a small status update, preview of things
to come and a new patch release. Sounds good? So, at the moment, our
team at the CZ.NIC Labs is working towards the next major thing, but
I'd like to reiterate that we didn't forget about the 1.4 and as of
today we have a new release with several important backported
bugfixes, here's the brief version:
* Two bugs related to authenticated denial of existence proof with a
certain combination of wildcard expansions triggering an assertion
failure
* Comparison of $ORIGIN and zone file in configuration is case insensitive
* Corrupted journal data caused a cleanup failure during the zone loading
In addition to the bugfixes, we have also slipped in a small
enhancement - "include" statement in the configuration can include
whole directory, this is useful if you have really a lot of includes
in one place.
Now a brief status update on what are we working on and what can you
expect in the next few weeks/months. The next major release is going
to happen later this spring and it's going to be focused on three
things mostly - covering the code by tests, cleaning up and polishing
existing features. There's going to be a feature or two, but that is
not the main focus. The reason is the functionality we have piled up
over the time has taken it's toll and now is the right time to sit
back and make the features leaner and meaner (that includes usability
as well), as that was always an integral idea behind Knot DNS. Plus
less things means less things to break, right?
I'd like to thank namely Petr Stastny and Olafur Gudmundsson (among
others) for bugreports, ideas and thoughts.
Full changelog:
https://gitlab.labs.nic.cz/labs/knot/blob/v1.4.3/NEWS
Sources:
https://secure.nic.cz/files/knot-dns/knot-1.4.3.tar.gzhttps://secure.nic.cz/files/knot-dns/knot-1.4.3.tar.xz
GPG signatures:
https://secure.nic.cz/files/knot-dns/knot-1.4.3.tar.gz.aschttps://secure.nic.cz/files/knot-dns/knot-1.4.3.tar.xz.asc
Kind Regards,
Marek
--
Marek Vavrusa, Knot DNS
CZ.NIC Labs http://www.knot-dns.cz
-------------------------------------------
Americká 23, 120 00 Praha 2, Czech Republic
WWW: http://labs.nic.czhttp://www.nic.cz
Hi Knot developers,
I have a feature request: I'd like a knotc command that will force Knot
to transfer a zone that is configured as a slave. The only command I can
issue at the moment is "refresh", but this will not transfer a zone if
Knot has a higher serial than the master.
Such a forced transfer command is useful to help recover from situations
where due to some operational error on the master server, the serial
number has gone back, and we deliberately need our Knot server to sync
to that old serial number. Without this command, the only way to make
Knot recover is to stop it, delete the zone file from disk and start it
again. But this is not ideal on a running server with lots of zones,
because the stop and start times can be quite high (in our case, 37s to
stop, and 1m30s to start).
Both BIND and NSD provide such commands to ignore the serial number
check and force zone transfers. I'd love to see such a command for Knot too.
Regards,
Anand
I started to play with the dnssec signing features in Knot.
I had this in my .conf file
B-100.tld { file "B-100.zone"; …. }
In the B-100.zone file I had
$ORIGIN B-100.tld.
I get
Jan 31 16:27:32 bigredone knot[31315]: [error] Zone 'B-100.tld.': mismatching origin in the zone file.
Jan 31 16:27:32 bigredone knot[31315]: [error] Failed to load zone 'B-100.tld.'.
When I changed to
$ORIGIN b-100.tld.
Same error
When I changed the conf line for B-100 to b-100
zone got loaded,
I when I changed Origin to upper case but kept the lower case in conf file then zone was loaded.
Summary: conf file requires zone name to be lower case, origin can be either case.
(not documented)
I do not think this what users expect.
Either respect the case that users present or downcase both zone name and name on $ORIGIN line
Also I would be great to have knot-checkzone command that one can use to verify the syntax of zone
with output to standard output.
Olafur
Hello,
I'm using Knot DNSSEC automatic signing and all is well and working.
How would one go about obtaining proper DS records for registrar glue
with least amount of trouble?
Thanks for Knot DNS, by far the most pleasant experience in comparison
with all other DNS servers. I've had zero issues with it, flawless
operation from the start!
