<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-15"
http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
Hi again,<br>
<br>
our nameservers now return the NXDOMAIN - Status, but now we have
further problems with nic.at because our .at - zone returns a
SOA-Record for queried zone.<br>
The configuration for zone-file "at.zone" looks like:<br>
<br>
############<br>
zone at dominic-zones/at.zone<br>
<br>
<br>
at. 3600 IN SOA rns-bind.dss. hostmaster.head.dss.
2007052100 3600 1800 3600000 600<br>
at. 86400 IN NS rns-bind.dss.<br>
at. 86400 IN NS rns-nsd.dss.<br>
############<br>
<br>
The "dig SOA"- command returns:<br>
<br>
[...]<br>
;; AUTHORITY SECTION:<br>
at. 600 IN SOA rns-bind.dss.
hostmaster.head.dss. 2007052100 3600 1800 3600000 600<br>
[...]<br>
<br>
#############################################################################<br>
<br>
Furthermore i tried the root-nameserver configuration.<br>
zone . dominic-zones/root.zone<br>
<br>
This root-zone also needs a SOA-Record for correct compilation.<br>
<br>
. 86400 IN SOA A.ROOT-SERVERS.NET.
NSTLD.VERISIGN-GRS.COM. 2007070501 1800 900 604800 86400<br>
. 459359 IN NS F.ROOT-SERVERS.NET.<br>
. 459359 IN NS G.ROOT-SERVERS.NET.<br>
. 459359 IN NS H.ROOT-SERVERS.NET.<br>
. 459359 IN NS I.ROOT-SERVERS.NET.<br>
. 459359 IN NS J.ROOT-SERVERS.NET.<br>
. 459359 IN NS K.ROOT-SERVERS.NET.<br>
. 459359 IN NS L.ROOT-SERVERS.NET.<br>
. 459359 IN NS M.ROOT-SERVERS.NET.<br>
. 459359 IN NS A.ROOT-SERVERS.NET.<br>
. 459359 IN NS B.ROOT-SERVERS.NET.<br>
. 459359 IN NS C.ROOT-SERVERS.NET.<br>
. 459359 IN NS D.ROOT-SERVERS.NET.<br>
. 459359 IN NS E.ROOT-SERVERS.NET.<br>
A.ROOT-SERVERS.NET. 3600000 IN A 198.41.0.4<br>
B.ROOT-SERVERS.NET. 3600000 IN A 192.228.79.201<br>
C.ROOT-SERVERS.NET. 3600000 IN A 192.33.4.12<br>
D.ROOT-SERVERS.NET. 3600000 IN A 128.8.10.90<br>
E.ROOT-SERVERS.NET. 3600000 IN A 192.203.230.10<br>
F.ROOT-SERVERS.NET. 3600000 IN A 192.5.5.241<br>
G.ROOT-SERVERS.NET. 3600000 IN A 192.112.36.4<br>
H.ROOT-SERVERS.NET. 3600000 IN A 128.63.2.53<br>
I.ROOT-SERVERS.NET. 3600000 IN A 192.36.148.17<br>
J.ROOT-SERVERS.NET. 3600000 IN A 192.58.128.30<br>
K.ROOT-SERVERS.NET. 3600000 IN A 193.0.14.129<br>
L.ROOT-SERVERS.NET. 3600000 IN A 198.32.64.12<br>
M.ROOT-SERVERS.NET. 3600000 IN A 202.12.27.33<br>
<br>
Is this a correct root-zone file for NSD? I did not found any examples
on the net.<br>
<br>
<br>
Is it possible to configure the nameserver, that he does not return
this SOA? <br>
<br>
<br>
Best regards,<br>
Irenäus <br>
<br>
<br>
<br>
<blockquote cite="mid:20070613224605.GA24241@denics7.denic.de"
type="cite">
<pre wrap="">On Wed, Jun 13, 2007 at 06:26:00PM +0200, Irenäus Becker wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Nic.at now checks all nameserver for existing entries for affected zone.
If all nameservers return a NXDOMAIN (Bind) everything is fine.
Our NSD nameservers return the status SERVFAIL. Nic.at interprets this
return-code as an error and does not finish this transaction completely.
</pre>
</blockquote>
<pre wrap=""><!---->
I haven't checked your view of nic.at's policies and/or procedures and would
appreciate a comment from AT. That said, ...
</pre>
<blockquote type="cite">
<pre wrap="">Is it possible to return a NXDOMAIN instead of a SERVFAIL? Are there
</pre>
</blockquote>
<pre wrap=""><!---->
... SERVFAIL is probably the more protocolly correct response but not the only
possible one.
Some scenarios are listed in <draft-koch-dns-unsolicited-queries-01.txt>
</pre>
<blockquote type="cite">
<pre wrap="">different possibilities how this point can be resolved?
</pre>
</blockquote>
<pre wrap=""><!---->
If you really need to respond NXDOMAIN (and again, I'm not saying you do),
one approach is to define an empty (lest the served delegations) parent TLD
(here: AT) zone on your server(s). But careful: there may be side effects
and you should make sure not to leak false information. The bottom line is:
if the problem exists, it can be solved by configuration, not by teaching
nsd to violate the protocol.
-Peter
</pre>
</blockquote>
<br>
</body>
</html>