2 Čec
2024
2 Čec
'24
23:39
knot fails to keep this zone updated. so i tested by hand
```
rip.psg.com:/home/randy# dig f.e.e.b.d.a.e.d.1.3.0.0.8.9.8.0.2.0.a.2.ip6.arpa
@94.142.241.91 axfr
; <<>> DiG 9.18.24-1-Debian <<>>
f.e.e.b.d.a.e.d.1.3.0.0.8.9.8.0.2.0.a.2.ip6.arpa @94.142.241.91 axfr
;; global options: +cmd
;; Warning: cannot represent 'xn--center-dla.test.globnix.net.' in the current
localedig: Cannot represent 'xn--ls8h.test.globnix.net.' in the current locale nor
ascii (string contains a disallowed character), use +noidnout or a different locale
```
`+noidnout` does fix it, but i am not sure i can get knot's axfr to do
that
the owner of the primary says
Okay, this is the zone with a whole bunch of records designed to
stress-test DNS implementations with things which are technically
allowed in DNS at the protocol level but which apps might not handle
well.
Zonefile top comment:
; This is the /80 reverse DNS used for test entries which should never be
; assigned to hosts. This is </48-prefix>:DEAD:BEEF::/80
Those particular records were added on 2013-04-05 per `git blame`:
233c7992 (Phil Pennock 2013-04-05 00:08:22 +0000 64) 0.6 PTR
mid\194\183dle.test.globnix.net.
233c7992 (Phil Pennock 2013-04-05 00:08:22 +0000 65) 1.6 PTR
xn--center-dla.test.globnix.net.
233c7992 (Phil Pennock 2013-04-05 00:08:22 +0000 66) 2.6 PTR
\240\159\146\169.test.globnix.net.
233c7992 (Phil Pennock 2013-04-05 00:08:22 +0000 67) 3.6 PTR
xn--ls8h.test.globnix.net.
so, `noidnout` is not in knot doc html file. clue bat, please.
randy
3 Čec
3 Čec
7:32
Hi,
The IDN transformation doesn't apply to AXFR nor to zone file flush, the domain names
are always encoded in Punycode (xn--).
You only must ensure that the input zone file doesn't contain Unicode characters.
If you still have any issues with the zone, please send me the source zone file for
investigation.
Daniel
On 02. 07. 24 23:39, Randy Bush wrote:
knot fails to keep this zone updated. so i tested by
hand
```
rip.psg.com:/home/randy# dig f.e.e.b.d.a.e.d.1.3.0.0.8.9.8.0.2.0.a.2.ip6.arpa
@94.142.241.91 axfr
; <<>> DiG 9.18.24-1-Debian <<>>
f.e.e.b.d.a.e.d.1.3.0.0.8.9.8.0.2.0.a.2.ip6.arpa @94.142.241.91 axfr
;; global options: +cmd
;; Warning: cannot represent 'xn--center-dla.test.globnix.net.' in the current
localedig: Cannot represent 'xn--ls8h.test.globnix.net.' in the current locale nor
ascii (string contains a disallowed character), use +noidnout or a different locale
```
`+noidnout` does fix it, but i am not sure i can get knot's axfr to do
that
the owner of the primary says
Okay, this is the zone with a whole bunch of records designed to
stress-test DNS implementations with things which are technically
allowed in DNS at the protocol level but which apps might not handle
well.
Zonefile top comment:
; This is the /80 reverse DNS used for test entries which should never be
; assigned to hosts. This is </48-prefix>:DEAD:BEEF::/80
Those particular records were added on 2013-04-05 per `git blame`:
233c7992 (Phil Pennock 2013-04-05 00:08:22 +0000 64) 0.6 PTR
mid\194\183dle.test.globnix.net.
233c7992 (Phil Pennock 2013-04-05 00:08:22 +0000 65) 1.6 PTR
xn--center-dla.test.globnix.net.
233c7992 (Phil Pennock 2013-04-05 00:08:22 +0000 66) 2.6 PTR
\240\159\146\169.test.globnix.net.
233c7992 (Phil Pennock 2013-04-05 00:08:22 +0000 67) 3.6 PTR
xn--ls8h.test.globnix.net.
so, `noidnout` is not in knot doc html file. clue bat, please.
randy
--
21:15
daniel,
The IDN transformation doesn't apply to AXFR nor
to zone file flush,
the domain names are always encoded in Punycode (xn--).
You only must ensure that the input zone file doesn't contain Unicode
characters.
RFC 2181 §11 on Name Syntax
Implementations of the DNS protocols must not place any restrictions
on the labels that can be used. In particular, DNS servers must not
refuse to serve a zone because it contains labels that might not be
acceptable to some DNS client programs. A DNS server may be
configurable to issue warnings when loading, or even to refuse to
load, a primary zone containing labels that might be considered
questionable, however this should not happen by default.
anaand tested and says that
BIND and NSD are correct here: they just load the zone
(BIND needs to
be configured to do so, but it provides the option).
If you still have any issues with the zone, please
send me the source
zone file for investigation.
attached
randy
4 Čec
4 Čec
13:17
Randy,
Knot DNS doesn't restrict any domain names. The problem you encountered is related to
the presentation format
of the records. If you use kdig for AXFR, some characters are escaped (e.g. colon), and
such a zone file is accepted
by our parser. Obviously, other implementations are more tolerant in this way. I'm not
aware of any rules on this.
Daniel
On 03. 07. 24 21:15, Randy Bush wrote:
daniel,
The IDN transformation doesn't apply to AXFR
nor to zone file flush,
the domain names are always encoded in Punycode (xn--).
You only must ensure that the input zone file doesn't contain Unicode
characters.
RFC 2181 §11 on Name Syntax
Implementations of the DNS protocols must not place any restrictions
on the labels that can be used. In particular, DNS servers must not
refuse to serve a zone because it contains labels that might not be
acceptable to some DNS client programs. A DNS server may be
configurable to issue warnings when loading, or even to refuse to
load, a primary zone containing labels that might be considered
questionable, however this should not happen by default.
anaand tested and says that
BIND and NSD are correct here: they just load the
zone (BIND needs to
be configured to do so, but it provides the option).
If you still have any issues with the zone,
please send me the source
zone file for investigation.
attached
randy
3 Čec
3 Čec
7:41
On Tue, 02 Jul 2024 14:39:18 -0700
Randy Bush <randy(a)psg.com> wrote:
knot fails to keep this zone updated. so i tested by
hand
```
rip.psg.com:/home/randy# dig
f.e.e.b.d.a.e.d.1.3.0.0.8.9.8.0.2.0.a.2.ip6.arpa @94.142.241.91 axfr
; <<>> DiG 9.18.24-1-Debian <<>>
f.e.e.b.d.a.e.d.1.3.0.0.8.9.8.0.2.0.a.2.ip6.arpa @94.142.241.91 axfr
;; global options: +cmd ;; Warning: cannot represent
'xn--center-dla.test.globnix.net.' in the current localedig: Cannot
represent 'xn--ls8h.test.globnix.net.' in the current locale nor
ascii (string contains a disallowed character), use +noidnout or a
different locale ```
`+noidnout` does fix it, but i am not sure i can get knot's axfr to do
that
I just transferred it without problems with kdig. Just added k at the
beginning of your command.
--
Tuomo Soini <tis(a)foobar.fi>
Foobar Linux services
+358 40 5240030
Foobar Oy <https://foobar.fi/>
10:18
On 02/07/2024 23:39, Randy Bush wrote:
Hi Randy,
knot fails to keep this zone updated. so i tested by
hand
What does Knot DNS log when attempting to refresh this zone?
Did you use "kzonecheck" on a manually XFR'ed copy of this zone? This
utility applies the same checks as "knotd", so if the zone has something
that "knotd" doesn't like, you'll know.
Regards,
Anand
144
days inactive
146
days old
5 comments
4 participants
participants (4)
-
Anand Buddhdev -
Daniel Salzman -
Randy Bush -
Tuomo Soini