<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Interesting - I will give it a try. I don’t know why I included the `IN`. I think I found an example and copied it!<div class=""><br class=""></div><div class="">I found I could remove the TTL and that led to my question concerning the default TTL or 3600.<div class=""><br class=""></div><div class="">Thank you for the response!</div><div class=""><br class=""></div><div class="">Jon</div><div class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Jan 10, 2024, at 7:37 AM, RayG <<a href="mailto:rgsub1@btinternet.com" class="">rgsub1@btinternet.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta charset="UTF-8" class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Verdana; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">I think you have the format wrong:<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">unbound-control.exe" local_data deb12dell.localdomain 60 A 192.168.60.175<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">unbound-control.exe" local_data 192.168.60.175.in-addr.arpa. 60 PTR deb12dell.localdomain<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">Works for me.<o:p class=""></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class=""><o:p class=""> </o:p></span></div><div class=""><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(225, 225, 225); padding: 3pt 0cm 0cm;" class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class="">From:</b><span class="Apple-converted-space"> </span>Jon Murphy <<a href="mailto:jcmurphy26@gmail.com" style="color: blue; text-decoration: underline;" class="">jcmurphy26@gmail.com</a>><span class="Apple-converted-space"> </span><br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Wednesday, January 10, 2024 4:07 AM<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>Fred Morris <<a href="mailto:m3047-unbound-b3u@m3047.net" style="color: blue; text-decoration: underline;" class="">m3047-unbound-b3u@m3047.net</a>><br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span><a href="mailto:unbound-users@lists.nlnetlabs.nl" style="color: blue; text-decoration: underline;" class="">unbound-users@lists.nlnetlabs.nl</a><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: A records, PTR records, and TTL setting<o:p class=""></o:p></div></div></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Fred,<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I am sorry for the late response. Otto informed me to look for your post. Your post made it to my email but then it just sat. Ugh!<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Thank you for your response!<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-family: Menlo-Regular, serif;" class="">I added details I did not include in my initial post: <o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-family: Menlo-Regular, serif;" class=""><a href="https://lists.nlnetlabs.nl/pipermail/unbound-users/2024-January/008207.html" style="color: blue; text-decoration: underline;" class="">https://lists.nlnetlabs.nl/pipermail/unbound-users/2024-January/008207.html</a><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-family: Menlo-Regular, serif;" class=""><o:p class=""> </o:p></span></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-family: Menlo-Regular, serif;" class="">And this January 1 update may help.<o:p class=""></o:p></span></div></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class="">My comments below,<o:p class=""></o:p></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Jon<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><br class=""><br class=""><o:p class=""></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class="" type="cite"><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class="">On Dec 25, 2023, at 2:45 PM, Fred Morris via Unbound-users <<a href="mailto:unbound-users@lists.nlnetlabs.nl" style="color: blue; text-decoration: underline;" class="">unbound-users@lists.nlnetlabs.nl</a>> wrote:<o:p class=""></o:p></div></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div class=""><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Happy holidays...<br class=""><br class="">On Sun, 24 Dec 2023, Jon Murphy via Unbound-users wrote:<br class=""><br class=""><o:p class=""></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class="" type="cite"><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class="">[...]<br class="">With a simple network (well defined, eh?) I am guessing it does not matter.<o:p class=""></o:p></div></blockquote><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><br class="">It doesn't matter has long as you have one address per name. X-D<br class=""><br class=""><br class=""><o:p class=""></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class="" type="cite"><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I can have one A and one PTR record per network interface.<o:p class=""></o:p></div></blockquote><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><br class="">You forget about the name in that algebra.<br class=""><br class=""><br class=""><o:p class=""></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class="" type="cite"><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class="">So for my "deb12dell.localdomain" device, it is OK to have "two" or each, like this:<br class=""><br class="">deb12dell.localdomain. 60 IN A 192.168.60.175<br class="">175.60.168.192.in-addr.arpa. 60 IN PTR deb12dell.localdomain.<br class="">deb12dell.localdomain. 60 IN A 192.168.65.180<br class="">180.65.168.192.in-addr.arpa. 60 IN PTR deb12dell.localdomain.<o:p class=""></o:p></div></blockquote><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><br class="">The name in that construction doesn't distinguish between interfaces.<o:p class=""></o:p></div></div></div></blockquote><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class="">The info is coming from the ISC-DHCP system I get a hostname and an IP address. I can modify the hostname and make the second item something like `deb12dell-1` and then pass that change to unbound.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class="">But this does not feel right…<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Right now there are two interfaces. One ethernet and one wireless. In the future there could be more.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><br class=""><br class=""><o:p class=""></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class="" type="cite"><div class=""><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><br class="">Are both interfaces accessible, everywhere? If not, then half of the attempts to reach deb12dell (using the A records) will initially fail. What happens after that depends on the software. There is no way to query for just one of the A records (unless you set up views or split horizon DNS), the software attempting to connect will have to decide which address to try, and whether or not to try them both.<br class=""><br class="">You've confounded the PTR record case (by using an intentionally unresolvable-on-the-internet name) making it more difficult to discuss, although I'm less concerned about it. Going back to the case of a mail server (a reminder, this isn't in the mail protocol, it's something people do as a practical test for legitimacy), as long as there's only one A record for a name it doesn't matter how many PTR records resolve to it because they'll never be enumerated by any normal DNS query:<br class=""><br class=""><a href="http://example.com/" style="color: blue; text-decoration: underline;" class="">example.com</a>. MX 10<span class="Apple-converted-space"> </span><a href="http://server.example.com/" style="color: blue; text-decoration: underline;" class="">server.example.com</a>.<br class=""><a href="http://server.example.com/" style="color: blue; text-decoration: underline;" class="">server.example.com</a>. A 10.0.1.111<br class="">111.1.0.10.in-addr.arpa. PTR<span class="Apple-converted-space"> </span><a href="http://server.example.com/" style="color: blue; text-decoration: underline;" class="">server.example.com</a>.<br class="">112.1.0.10.in-addr.arpa. PTR<span class="Apple-converted-space"> </span><a href="http://server.example.com/" style="color: blue; text-decoration: underline;" class="">server.example.com</a>.<o:p class=""></o:p></div></div></div></blockquote><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class="">For me, there is only a LAN or local network. And only A records and PTR records.<o:p class=""></o:p></div></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><br class=""><br class=""><o:p class=""></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class="" type="cite"><div class=""><div class=""><p class="MsoNormal" style="margin: 0cm 0cm 12pt; font-size: 11pt; font-family: Calibri, sans-serif;"><br class="">In case you wanted to encode some reliable identity information in the name (there be dragons! a file share would be a bad application of this, at least without some other authentication / access controls) let's say a file share that is only accessible to the "downtown" office you could have a whole bunch of PTR records resolving to downtown.office.localdomain, the A records don't have to agree with the PTR records for that purpose:<br class=""><br class=""><a href="http://joe.downtown.example.com/" style="color: blue; text-decoration: underline;" class="">joe.downtown.example.com</a>. A 10.0.0.22<br class=""><a href="http://jean.downtown.example.com/" style="color: blue; text-decoration: underline;" class="">jean.downtown.example.com</a>. A 10.0.0.28<br class="">22.0.0.10.in-addr.arpa. PTR<span class="Apple-converted-space"> </span><a href="http://downtown.example.com/" style="color: blue; text-decoration: underline;" class="">downtown.example.com</a>.<br class="">28.0.0.10.in-addr.arpa. PTR<span class="Apple-converted-space"> </span><a href="http://downtown.example.com/" style="color: blue; text-decoration: underline;" class="">downtown.example.com</a>.<br class=""><br class="">There are two different ways some sort of access control can work in the above scenario, and it's up to the server architect how it works:<br class=""><br class="">1) You list<span class="Apple-converted-space"> </span><a href="http://joe.downtown.example.com/" style="color: blue; text-decoration: underline;" class="">joe.downtown.example.com</a><span class="Apple-converted-space"> </span>and<span class="Apple-converted-space"> </span><a href="http://jean.downtown.example.com/" style="color: blue; text-decoration: underline;" class="">jean.downtown.example.com</a><span class="Apple-converted-space"> </span>as<br class=""> permitted. When the service starts it performs A record lookups and<br class=""> stores the addresses 10.0.0.22 and 10.0.0.28 internally. When a<br class=""> connection attempt is made, it compares the client's address with<br class=""> 10.0.0.22 amd 10.0.0.28 to see if it's one of those.<br class=""><br class="">2) You list<span class="Apple-converted-space"> </span><a href="http://downtown.example.com/" style="color: blue; text-decoration: underline;" class="">downtown.example.com</a><span class="Apple-converted-space"> </span>as permitted. This FQDN is read, but no<br class=""> lookups are performed at service startup. When a connection attempt is<br class=""> made, a PTR lookup is performed for the address and it compares the<br class=""> FQDN with what it stored at startup.<o:p class=""></o:p></p></div></div></blockquote><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Wow - this is over my head! <o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><br class=""><br class=""><o:p class=""></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class="" type="cite"><div class=""><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class="">(I see you picked up on the need for the trailing dot, good for you!)<o:p class=""></o:p></div></div></div></blockquote><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Thank you! Based on what I read it seemed like the right thing to make it an absolute path.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><br class=""><br class=""><o:p class=""></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class="" type="cite"><div class=""><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><br class="">Kind of depends on your use case, or application; it's usually not configurable. There are three questions to ask:<br class=""><br class="">1) Is the A record compared to the PTR record for identity?<o:p class=""></o:p></div></div></div></blockquote><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Yes.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><br class=""><br class=""><o:p class=""></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class="" type="cite"><div class=""><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class="">2) Is the A record query made at startup, and the address recorded and<br class=""> used going forward?<o:p class=""></o:p></div></div></div></blockquote><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class="">It may or may not be at start-up since my info comes from ISC-DHCP. It could happen, or even change, as devices come and go.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><br class=""><br class=""><o:p class=""></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class="" type="cite"><div class=""><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class="">3) Is the PTR record query made at access time?<o:p class=""></o:p></div></div></div></blockquote><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I am not understanding the question. I now there are reverse lookups.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Thank you!<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Jon<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><br class=""><br class=""><o:p class=""></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class="" type="cite"><div class=""><div class=""><p class="MsoNormal" style="margin: 0cm 0cm 12pt; font-size: 11pt; font-family: Calibri, sans-serif;"><br class="">--<br class=""><br class="">Fred Morris</p></div></div></blockquote></div></div></div></div></blockquote></div><br class=""></div></div></body></html>