30 Čen
2015
30 Čen
'15
17:14
I'm migration from PowerDNS using AXFR and some of the domains fall on
Section 2.4 having CNAME on top domains.
Is there a way to ignore the warning and receive the query?
An example of troublesome domain transfer:
Jun 30 11:33:40 p-01 knot[2930]: info: [strangedomain.com] AXFR, incoming,
127.0.0.1@53: starting
Jun 30 11:33:40 p-01 knot[2930]: warning: [strangedomain.com] semantic
check, node 'strangedomain.com.' (CNAME, node contains other records than
RRSIG and NSEC/NSEC3)
Jun 30 11:33:40 p-01 knot[2930]: error: [strangedomain.com] AXFR, incoming,
127.0.0.1@53: failed (failed)
Jun 30 11:33:40 p-01 knot[2930]: error: [strangedomain.com] transfer,
failed (no active master)
I'm running on Gentoo compiling Knotd 1.6.4 from source w/ no special flags.
Thanks in advance!
--
[ ]'s
Filipe Cifali Stangler
30 Čen
30 Čen
17:37
tis 2015-06-30 klockan 12:14 -0300 skrev Filipe Cifali:
I'm migration from PowerDNS using AXFR and some of
the domains fall on
Section 2.4 having CNAME on top domains.
Is there a way to ignore the warning and receive the query?
...
Out of curiosity, why don't you simply fix the broken zones?
// Andreas
17:44
My clients broke their own zones, sadly when I first started the sysadmins
already made it to "function" this way.
Freedom to the users, doom to the admins.
By making them compliant to RFC1912 I would potentially take off their
sites down and that's not an option atm.
On Tue, Jun 30, 2015 at 12:37 PM, Andreas Olsson <andreas(a)arrakis.se> wrote:
tis 2015-06-30 klockan 12:14 -0300 skrev Filipe
Cifali:
--
[ ]'s
Filipe Cifali Stangler
I'm migration from PowerDNS using AXFR and
some of the domains fall on
Section 2.4 having CNAME on top domains.
Is there a way to ignore the warning and receive the query?
...
Out of curiosity, why don't you simply fix the broken zones?
// Andreas
_______________________________________________
knot-dns-users mailing list
knot-dns-users(a)lists.nic.cz
https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
1 Čec
1 Čec
17:38
Some more information that I found:
The option:
https://www.knot-dns.cz/docs/1.6/html/reference.html#zones-list-of-zone-sem…
Doesn't not seem to work for AXFR on my setup, each zone that I need to
transfer has:
xfr-in master;
notify-in master;
update-in master;
Declared and in the main config:
remotes {
master { address 127.0.0.1@53; }
}
zones {
...
semantic-checks off;
}
But I still get warnings and transfer failed while doing the AXFR transfer.
On Tue, Jun 30, 2015 at 12:44 PM, Filipe Cifali <cifali.filipe(a)gmail.com>
wrote:
My clients broke their own zones, sadly when I first
started the sysadmins
already made it to "function" this way.
Freedom to the users, doom to the admins.
By making them compliant to RFC1912 I would potentially take off their
sites down and that's not an option atm.
On Tue, Jun 30, 2015 at 12:37 PM, Andreas Olsson <andreas(a)arrakis.se>
wrote:
--
[ ]'s
Filipe Cifali Stangler
tis 2015-06-30 klockan 12:14 -0300 skrev Filipe
Cifali:
--
[ ]'s
Filipe Cifali Stangler
I'm migration from PowerDNS using AXFR and
some of the domains fall on
Section 2.4 having CNAME on top domains.
Is there a way to ignore the warning and receive the query?
...
Out of curiosity, why don't you simply fix the broken zones?
// Andreas
_______________________________________________
knot-dns-users mailing list
knot-dns-users(a)lists.nic.cz
https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
12:57
Hello Jan,
it's only failing for the zones w/ problems w/ CNAMEs, ignoring the
semantic-check off on the config.
On Thu, Jul 2, 2015 at 4:48 AM, Jan Včelák <jan.vcelak(a)nic.cz> wrote:
Hello Filipe,
--
[ ]'s
Filipe Cifali Stangler
But I still get warnings and transfer failed
while doing the AXFR
transfer.
Is the transfer failing for all zones or only for the zones with the
CNAMEs in
apex?
Regards,
Jan
13:49
Hello Filipe,
On Thursday, July 02, 2015 07:57:46 AM Filipe Cifali wrote:
it's only failing for the zones w/ problems w/
CNAMEs, ignoring the
semantic-check off on the config.
I have just taken a look to make sure: This particular check is mandatory and
cannot be disabled. And I'm quite sure I want to keep it that way. The CNAME
in apex is not allowed. And we would have to define some behavior how to
answer when this happens, which makes a little sense.
You should rather urge your clients to fix their zones because this problem
can lead to random resolution failures.
Cheers,
Jan
7 Čec
7 Čec
16:59
Thanks, I finished fixing all the zones now, finally.
Anyone has ever used PowerDNS as master of a Knotd slave? I'm missing
something since PowerDNS returns connection refused after the initial
transfer, like it's not responding correctly to PowerDNS.
Since I can dig AXFR @127.0.0.1 (which has PowerDNS running) I don't see
how he can be wrong.
I'm not sure where to go looking for the problem here.
Best Regards,
[ ]'s
On Thu, Jul 2, 2015 at 8:49 AM, Jan Včelák <jan.vcelak(a)nic.cz> wrote:
Hello Filipe,
On Thursday, July 02, 2015 07:57:46 AM Filipe Cifali wrote:
--
[ ]'s
Filipe Cifali Stangler
it's only failing for the zones w/ problems
w/ CNAMEs, ignoring the
semantic-check off on the config.
I have just taken a look to make sure: This particular check is mandatory
and
cannot be disabled. And I'm quite sure I want to keep it that way. The
CNAME
in apex is not allowed. And we would have to define some behavior how to
answer when this happens, which makes a little sense.
You should rather urge your clients to fix their zones because this problem
can lead to random resolution failures.
Cheers,
Jan
_______________________________________________
knot-dns-users mailing list
knot-dns-users(a)lists.nic.cz
https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
17:12
Hello Filipe,
does the PowerDNS server respond to SOA queries over TCP?
$ dig +tcp @127.0.0.1 zone.name SOA
Cheers,
Jan
On Tuesday, July 07, 2015 11:59:00 AM Filipe Cifali wrote:
Thanks, I finished fixing all the zones now, finally.
Anyone has ever used PowerDNS as master of a Knotd slave? I'm missing
something since PowerDNS returns connection refused after the initial
transfer, like it's not responding correctly to PowerDNS.
Since I can dig AXFR @127.0.0.1 (which has PowerDNS running) I don't see
how he can be wrong.
I'm not sure where to go looking for the problem here.
Best Regards,
[ ]'s
On Thu, Jul 2, 2015 at 8:49 AM, Jan Včelák <jan.vcelak(a)nic.cz> wrote:
> Hello Filipe,
>
> On Thursday, July 02, 2015 07:57:46 AM Filipe Cifali wrote:
> > it's only failing for the zones w/ problems w/ CNAMEs, ignoring the
> > semantic-check off on the config.
>
> I have just taken a look to make sure: This particular check is mandatory
> and
> cannot be disabled. And I'm quite sure I want to keep it that way. The
> CNAME
> in apex is not allowed. And we would have to define some behavior how to
> answer when this happens, which makes a little sense.
>
> You should rather urge your clients to fix their zones because this
> problem
> can lead to random resolution failures.
>
> Cheers,
>
> Jan
> _______________________________________________
> knot-dns-users mailing list
> knot-dns-users(a)lists.nic.cz
> https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
17:41
Yes, w/ aa flag and all the SOA record
On Tue, Jul 7, 2015 at 12:12 PM, Jan Včelák <jan.vcelak(a)nic.cz> wrote:
Hello Filipe,
does the PowerDNS server respond to SOA queries over TCP?
$ dig +tcp @127.0.0.1 zone.name SOA
Cheers,
Jan
On Tuesday, July 07, 2015 11:59:00 AM Filipe Cifali wrote:
--
[ ]'s
Filipe Cifali Stangler
Thanks, I finished fixing all the zones now,
finally.
Anyone has ever used PowerDNS as master of a Knotd slave? I'm missing
something since PowerDNS returns connection refused after the initial
transfer, like it's not responding correctly to PowerDNS.
Since I can dig AXFR @127.0.0.1 (which has PowerDNS running) I don't see
how he can be wrong.
I'm not sure where to go looking for the problem here.
Best Regards,
[ ]'s
On Thu, Jul 2, 2015 at 8:49 AM, Jan Včelák <jan.vcelak(a)nic.cz> wrote:
> Hello Filipe,
>
> On Thursday, July 02, 2015 07:57:46 AM Filipe Cifali wrote:
> > it's only failing for the zones w/ problems w/ CNAMEs, ignoring the
> > semantic-check off on the config.
>
> I have just taken a look to make sure: This particular check is
mandatory
> and
> cannot be disabled. And I'm quite sure I want to keep it that way. The
> CNAME
> in apex is not allowed. And we would have to define some behavior how
to
> answer when this happens, which makes a
little sense.
>
> You should rather urge your clients to fix their zones because this
> problem
> can lead to random resolution failures.
>
> Cheers,
>
> Jan
> _______________________________________________
> knot-dns-users mailing list
> knot-dns-users(a)lists.nic.cz
> https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
_______________________________________________
knot-dns-users mailing list
knot-dns-users(a)lists.nic.cz
https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
20:10
Also what does the Knot DNS logs say at debug level?
We definitely have a user with similar setup (I'm Bccing him, so he can respond at his
will) - PowerDNS as a primary and Knot DNS as a secondary.
If you are into a deeper debugging, could you capture the packets between Knot secondary
and PowerDNS primary?
Cheers,
Ondrej
--
Ondřej Surý -- Chief Science Officer
--------------------------------------------
CZ.NIC, z.s.p.o. -- Laboratoře CZ.NIC
Milesovska 5, 130 00 Praha 3, Czech Republic
mailto:ondrej.sury@nic.cz https://nic.cz/
--------------------------------------------
From: "Filipe Cifali"
<cifali.filipe(a)gmail.com>
Cc: knot-dns-users(a)lists.nic.cz
Sent: Tuesday, July 7, 2015 5:41:17 PM
Subject: Re: [knot-dns-users] AXFR - RFC1912
Yes, w/ aa flag and all the SOA record
On Tue, Jul 7, 2015 at 12:12 PM, Jan Včelák <
jan.vcelak(a)nic.cz > wrote:
> Hello Filipe,
> does the PowerDNS server respond to SOA queries
over TCP?
> $ dig +tcp @ 127.0.0.1 zone.name SOA
> Cheers,
> Jan
> On Tuesday, July 07, 2015 11:59:00 AM Filipe
Cifali wrote:
> > Thanks, I finished fixing all the zones now, finally.
> > Anyone has ever used PowerDNS as master of a
Knotd slave? I'm missing
> > something since PowerDNS returns connection refused after the initial
> > transfer, like it's not responding correctly to PowerDNS.
> > Since I can dig AXFR @ 127.0.0.1 (which has
PowerDNS running) I don't see
> > how he can be wrong.
> > I'm not sure where to go looking for the
problem here.
> > Best Regards,
> > [ ]'s
> > On Thu, Jul 2, 2015 at 8:49 AM, Jan Včelák
< jan.vcelak(a)nic.cz > wrote:
> > > Hello Filipe,
> > > On Thursday, July 02, 2015 07:57:46 AM
Filipe Cifali wrote:
> > > > it's only failing for the zones w/ problems w/ CNAMEs, ignoring
the
> > > > semantic-check off on the config.
> > > I have just taken a look to make sure:
This particular check is mandatory
> > > and
> > > cannot be disabled. And I'm quite sure I want to keep it that way. The
> > > CNAME
> > > in apex is not allowed. And we would have to define some behavior how to
> > > answer when this happens, which makes a little sense.
> > > You should rather urge your clients to
fix their zones because this
> > > problem
> > > can lead to random resolution failures.
> > > Cheers,
> > > Jan
> > > _______________________________________________
> > > knot-dns-users mailing list
> > > knot-dns-users(a)lists.nic.cz
> > > https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
> _______________________________________________
> knot-dns-users mailing list
> knot-dns-users(a)lists.nic.cz
> https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
--
[ ]'s
Filipe Cifali Stangler
_______________________________________________
knot-dns-users mailing list
knot-dns-users(a)lists.nic.cz
https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
21:26
Oh I made it work after debugging enough I could get the info needed.
Without debug is very hard to understand why AXFR fails, it only returns
"connection refused".
Thanks for the attention anyway :)
On Tue, Jul 7, 2015 at 3:10 PM, Ondřej Surý <ondrej.sury(a)nic.cz> wrote:
Also what does the Knot DNS logs say at debug level?
We definitely have a user with similar setup (I'm Bccing him, so he can
respond at his will) - PowerDNS as a primary and Knot DNS as a secondary.
If you are into a deeper debugging, could you capture the packets between
Knot secondary and PowerDNS primary?
Cheers,
Ondrej
--
Ondřej Surý -- Chief Science Officer
--------------------------------------------
CZ.NIC, z.s.p.o. -- Laboratoře CZ.NIC
Milesovska 5, 130 00 Praha 3, Czech Republic
mailto:ondrej.sury@nic.cz https://nic.cz/
--------------------------------------------
------------------------------
*From: *"Filipe Cifali" <cifali.filipe(a)gmail.com>
*Cc: *knot-dns-users(a)lists.nic.cz
*Sent: *Tuesday, July 7, 2015 5:41:17 PM
*Subject: *Re: [knot-dns-users] AXFR - RFC1912
Yes, w/ aa flag and all the SOA record
On Tue, Jul 7, 2015 at 12:12 PM, Jan Včelák <jan.vcelak(a)nic.cz> wrote:
--
[ ]'s
Filipe Cifali Stangler
Hello Filipe,
does the PowerDNS server respond to SOA queries over TCP?
$ dig +tcp @127.0.0.1 zone.name SOA
Cheers,
Jan
On Tuesday, July 07, 2015 11:59:00 AM Filipe Cifali wrote:
--
[ ]'s
Filipe Cifali Stangler
_______________________________________________
knot-dns-users mailing list
knot-dns-users(a)lists.nic.cz
https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
Thanks, I finished fixing all the zones now,
finally.
Anyone has ever used PowerDNS as master of a Knotd slave? I'm missing
something since PowerDNS returns connection refused after the initial
transfer, like it's not responding correctly to PowerDNS.
Since I can dig AXFR @127.0.0.1 (which has PowerDNS running) I don't
see
how he can be wrong.
I'm not sure where to go looking for the problem here.
Best Regards,
[ ]'s
On Thu, Jul 2, 2015 at 8:49 AM, Jan Včelák <jan.vcelak(a)nic.cz> wrote:
> Hello Filipe,
>
> On Thursday, July 02, 2015 07:57:46 AM Filipe Cifali wrote:
> > it's only failing for the zones w/ problems w/ CNAMEs, ignoring the
> > semantic-check off on the config.
>
> I have just taken a look to make sure: This particular check is
mandatory
> and
> cannot be disabled. And I'm quite sure I want to keep it that way. The
> CNAME
> in apex is not allowed. And we would have to define some behavior how
to
> answer when this happens, which makes a
little sense.
>
> You should rather urge your clients to fix their zones because this
> problem
> can lead to random resolution failures.
>
> Cheers,
>
> Jan
> _______________________________________________
> knot-dns-users mailing list
> knot-dns-users(a)lists.nic.cz
> https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
_______________________________________________
knot-dns-users mailing list
knot-dns-users(a)lists.nic.cz
https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
10 Čec
10 Čec
16:22
Hi Filipe,
we have PowerDNS as master and Knot as slave, working without any
problem.
Your Knot setup seams similar to ours, w just dot have update-in master;
in zone but everything else is same. We also had problem with CNAMES
when we started to use Knot :) but that is fault of PowerDNS (or DNS
admins), not Knot.
Only thing which comes to my mind is if you have AXFR transfers allowed
in PowerDNS? You should have option
allow-axfr-ips=<ip of server with knot>
and maybe in your case with update-in you should also set
allow-dnsupdate-from=<ip of server with knot>
Both are probably allowing traffic from 127.0.0.1 if you have that enabled.
I kind of dont understand one thing in your setup. You have PowerDNS and
Knot on same server? hey are running on different ports or how this works?
Please cc me if you want my reaction, I'm not on the list currently.
--
Kepi
igloonet.cz | fb.com/igloonet
Ondřej Surý <ondrej.sury(a)nic.cz> writes:
Also what does the Knot DNS logs say at debug level?
We definitely have a user with similar setup (I'm Bccing him, so he
can respond at his will) - PowerDNS as a primary and Knot DNS as a
secondary.
If you are into a deeper debugging, could you capture the packets
between Knot secondary and PowerDNS primary?
Cheers,
Ondrej
--
Ondřej Surý -- Chief Science Officer
--------------------------------------------
CZ.NIC, z.s.p.o. -- Laboratoře CZ.NIC
Milesovska 5, 130 00 Praha 3, Czech Republic
mailto:ondrej.sury@nic.cz https://nic.cz/
--------------------------------------------
----------------------------------------------------------------------
From: "Filipe Cifali" <cifali.filipe(a)gmail.com>
Cc: knot-dns-users(a)lists.nic.cz
Sent: Tuesday, July 7, 2015 5:41:17 PM
Subject: Re: [knot-dns-users] AXFR - RFC1912
Yes, w/ aa flag and all the SOA record
On Tue, Jul 7, 2015 at 12:12 PM, Jan Včelák <jan.vcelak(a)nic.cz>
wrote:
Hello Filipe,
does the PowerDNS server respond to SOA queries over TCP?
$ dig +tcp @127.0.0.1 zone.name SOA
Cheers,
Jan
On Tuesday, July 07, 2015 11:59:00 AM Filipe Cifali wrote:
Thanks, I finished fixing all the zones now,
finally.
Anyone has ever used PowerDNS as master of a Knotd slave?
I'm missing
something since PowerDNS returns connection
refused after
the initial
transfer, like it's not responding correctly
to PowerDNS.
Since I can dig AXFR @127.0.0.1 (which has PowerDNS running)
I don't
see
how he can be wrong.
I'm not sure where to go looking for the problem here.
Best Regards,
[ ]'s
On Thu, Jul 2, 2015 at 8:49 AM, Jan Včelák
<jan.vcelak(a)nic.cz>
wrote:
> Hello Filipe,
>
> On Thursday, July 02, 2015 07:57:46 AM Filipe Cifali
wrote:
> > it's only failing for the zones w/
problems w/ CNAMEs,
ignoring the
> > semantic-check off on the config.
>
> I have just taken a look to make sure: This particular
check is
mandatory
> and
> cannot be disabled. And I'm quite sure I want to keep it
that
way. The
> CNAME
> in apex is not allowed. And we would have to define some
behavior how
to
> answer when this happens, which makes a
little sense.
>
> You should rather urge your clients to fix their zones
because this
> > problem
> > can lead to random resolution failures.
> >
> > Cheers,
> >
> > Jan
16:57
Hello Kepi, thanks for replying!
I already made it work but thanks anyway, good to know more people using
the same way we plan o using.
Regarding the performance, are you guys using regular FS to store or some
kind of tmpfs/ramfs?
The startup is slow for lots of zones or I can improve it somehow?
On Fri, Jul 10, 2015 at 11:22 AM, Kepi <kepi(a)igloonet.cz> wrote:
Hi Filipe,
we have PowerDNS as master and Knot as slave, working without any
problem.
Your Knot setup seams similar to ours, w just dot have update-in master;
in zone but everything else is same. We also had problem with CNAMES
when we started to use Knot :) but that is fault of PowerDNS (or DNS
admins), not Knot.
Only thing which comes to my mind is if you have AXFR transfers allowed
in PowerDNS? You should have option
allow-axfr-ips=<ip of server with knot>
and maybe in your case with update-in you should also set
allow-dnsupdate-from=<ip of server with knot>
Both are probably allowing traffic from 127.0.0.1 if you have that enabled.
I kind of dont understand one thing in your setup. You have PowerDNS and
Knot on same server? hey are running on different ports or how this works?
Please cc me if you want my reaction, I'm not on the list currently.
--
Kepi
igloonet.cz | fb.com/igloonet
Ondřej Surý <ondrej.sury(a)nic.cz> writes:
--
[ ]'s
Filipe Cifali Stangler
Also what does the Knot DNS logs say at debug
level?
We definitely have a user with similar setup (I'm Bccing him, so he
can respond at his will) - PowerDNS as a primary and Knot DNS as a
secondary.
If you are into a deeper debugging, could you capture the packets
between Knot secondary and PowerDNS primary?
Cheers,
Ondrej
--
Ondřej Surý -- Chief Science Officer
--------------------------------------------
CZ.NIC, z.s.p.o. -- Laboratoře CZ.NIC
Milesovska 5, 130 00 Praha 3, Czech Republic
mailto:ondrej.sury@nic.cz https://nic.cz/
--------------------------------------------
----------------------------------------------------------------------
From: "Filipe Cifali" <cifali.filipe(a)gmail.com>
Cc: knot-dns-users(a)lists.nic.cz
Sent: Tuesday, July 7, 2015 5:41:17 PM
Subject: Re: [knot-dns-users] AXFR - RFC1912
Yes, w/ aa flag and all the SOA record
On Tue, Jul 7, 2015 at 12:12 PM, Jan Včelák <jan.vcelak(a)nic.cz>
wrote:
Hello Filipe,
does the PowerDNS server respond to SOA queries over TCP?
$ dig +tcp @127.0.0.1 zone.name SOA
Cheers,
Jan
On Tuesday, July 07, 2015 11:59:00 AM Filipe Cifali wrote:
Thanks, I finished fixing all the zones now,
finally.
Anyone has ever used PowerDNS as master of a Knotd slave?
I'm missing
something since PowerDNS returns connection
refused after
the initial
transfer, like it's not responding correctly
to PowerDNS.
Since I can dig AXFR @127.0.0.1 (which has PowerDNS running)
I don't
see
how he can be wrong.
I'm not sure where to go looking for the problem here.
Best Regards,
[ ]'s
On Thu, Jul 2, 2015 at 8:49 AM, Jan Včelák
<jan.vcelak(a)nic.cz>
wrote:
> Hello Filipe,
>
> On Thursday, July 02, 2015 07:57:46 AM Filipe Cifali
wrote:
> > it's only failing for the zones w/
problems w/ CNAMEs,
ignoring the
> > semantic-check off on the config.
>
> I have just taken a look to make sure: This particular
check is
mandatory
> and
> cannot be disabled. And I'm quite sure I want to keep it
that
way. The
> CNAME
> in apex is not allowed. And we would have to define some
behavior how
to
> answer when this happens, which makes a
little sense.
>
> You should rather urge your clients to fix their zones
because this
> > problem
> > can lead to random resolution failures.
> >
> > Cheers,
> >
> > Jan
3453
days inactive
3463
days old
13 comments
5 participants
participants (5)
-
Andreas Olsson -
Filipe Cifali -
Jan Včelák -
Kepi -
Ondřej Surý