This is *exactly* why there is a rule in RFC 1034 prohibiting
the use of CNAME with anything else. This is also why named
enforces the rule. The operators of share-ideas.com are
in violation of this rule and their nameserver does not
enforce this rule.

RFC 1034.

The domain system provides such a feature using the canonical name
(CNAME) RR. A CNAME RR identifies its owner name as an alias, and
specifies the corresponding canonical name in the RDATA section of the
RR. If a CNAME RR is present at a node, no other data should be
present; this ensures that the data for a canonical name and its aliases
cannot be different. This rule also insures that a cached CNAME can be
used without checking with an authoritative server for other RR types.

Mark

%% dig crm.share-ideas.com @ns2.hc.ru.

This is a multi-part message in MIME format.
--===============9138268836688720276==
Content-Type: multipart/alternative;
boundary="------------000403080708090601030900"

This is a multi-part message in MIME format.
--------------000403080708090601030900
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

At Fri, 26 Dec 2008 14:28:13 +0100, Nico De Ranter wrote:

The error suggests that you don't really have GSSAPI enabled
(dst_gssapi_acquirecred() returns that error when called with GSSAPI
support disabled). Check your build log to make sure that -DGSSAPI
was included on the command line when compiling lib/dns/gssapictx.c.
If not, you've got some kind of autoconf problem or are specifying the
wrong directory for the GSSAPI libraries, so check config.log next to
see what happened.
_______________________________________________
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Unfortunately I can't get it to work.

When I add

tkey-gssapi-credential "DNS/....";
tkey-domain "...";

to my named.conf file, named doesn't want to start anymore. I get the
following message in /var/log/messages:

Dec 26 13:55:33 dns named[8546]: configuring TKEY: not implemented
Dec 26 13:55:33 dns named[8546]: loading configuration: not implemented
Dec 26 13:55:33 dns named[8546]: exiting (due to fatal error)

I compiled bind 9.6.0 using the following options:

./configure --with-openssl=yes \
--with-randomdev=/dev/urandom \
--prefix=/opt/bind-${BINDVER} \
--sysconfdir=/etc/bind-${BINDVER} \
--enable-threads \
--with-pkcs11 \
--with-gssapi=/usr

Did anyone try restricting nsupdate by using tcp-wrappers? I heard
that we can restrict nsupdate using tcp-wrapper
Anyone tried this?

cheers
Maani

On Nov 17, 9:06 pm, "Jonathan Petersson"
wrote:

Linux Addict wrote:

TCP? You must open in firewall:

allow tcp,udp from me to any 53
allow tcp,udp from any 53 to me

On Wednesday 24 December 2008 20:13, Scott Haneda wrote:

OK, I get the sam answers form all the NS servers.

Trying to help a client, they stumped me today.

dig crm.share-ideas.com

; <<>> DiG 9.4.2-P2 <<>> crm.share-ideas.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35978
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;crm.share-ideas.com. IN A

;; ANSWER SECTION:
crm.share-ideas.com. 3600 IN A 213.242.225.169

;; Query time: 999 msec
;; SERVER: 208.57.0.11#53(208.57.0.11)
;; WHEN: Wed Dec 24 07:51:24 2008
;; MSG SIZE rcvd: 53

Estar=E9 ausente de la oficina desde el 24/12/2008 y no volver=E9 hasta el
14/01/2009.

Para cualquier asunto contacte Francisco Javier Fabian Sanchez, Francisco
Javier Fernandez Gonzalez, Javier Soria Gallego, Carlos Montero o Jose
Antonio Pulido.

___________________________________________________________________________

Este mensaje se dirige exclusivamente a su destinatario y puede contener
informaci=F3n privilegiada o confidencial. Si no es vd. el destinatario
indicado, queda notificado de que la lectura, utilizaci=F3n, divulgaci=F3n =
y/o
copia sin autorizaci=F3n est=E1 prohibida en virtud de la legislaci=F3n vig=
ente.
Si ha recibido este mensaje por error, le rogamos que nos lo comunique
inmediatamente por esta misma v=EDa y proceda a su destrucci=F3n.

El correo electr=F3nico v=EDa Internet no permite asegurar la confidenciali=
dad
de los mensajes que se transmiten ni su integridad o correcta recepci=F3n.
Telef=F3nica no asume ninguna responsabilidad por estas circunstancias.

On Wed, 24 Dec 2008, Linux Addict wrote:

Tell us more. Show us more.

Is your named bound to the IP (at port 53) as expected? Use netstat -an,
sockstat, lsof, fstat to see.

How are you testing? Show us your dig output from same system running
named. Also from remote system if you are testing from a client.

Make sure allow-query, allow-query-cache, allow-recursion are set as
required.
_______________________________________________
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users