My one caution on this would be you may run into false negatives with TCP if people have misconfigured firewalls.<br>It's surprising the number of people out there that believe TCP is only for xfers.<br><br>-- <br>-Ben Croswell<br>
<br><br><div class="gmail_quote">On Tue, Apr 7, 2009 at 3:17 PM, Mark Elkins <span dir="ltr"><<a href="mailto:mje@posix.co.za">mje@posix.co.za</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
I'm involved in the <a href="http://CO.ZA" target="_blank">CO.ZA</a> Registry. In the process of registering a<br>
domain name in the <a href="http://co.za" target="_blank">co.za</a> zone - we do a bunch of DNS checks using<br>
'dig'.<br>
<br>
for each nameserver,<br>
a) check that the zone exists (fetch the SOA),<br>
b) fetch the NS RRSet count and compare entries.<br>
c) if Nameserver inside the domain being registered (glue needed)<br>
i) check the reverse glue (can be multiple v4 + v6 addresses)<br>
ii) check each reverse has a forward<br>
<br>
<br>
Currently - many of these (dig-9.4.1) checks include the flags +time=9<br>
+retry=5..<br>
<br>
..the assumption being that for any 'dig' action - try, timeout 9<br>
seconds - repeat another 5 times... - so a totally failed lookup would<br>
take 54 seconds... however - an ethernet trace/dump seems to indicate<br>
queries go out one after the other - with little inter-query delay..<br>
<br>
If we do a lookup with UDP - a low but significant number of 'digs' fail<br>
- which results in our checks failing - and the registration checking<br>
process delaying that particular registration for a few hours.<br>
<br>
If we switch to using TCP for 'dig' lookups - the failure rate<br>
basically disappears to Zero. This would result in happier customers<br>
(less registration delays).<br>
<br>
I've always been taught (and teach others) to use UDP and not TCP for<br>
DNS queries - but in the case of a registry checking for info like we do<br>
- would it not be politically correct to instead do TCP checks?<br>
<br>
What does the net-dns wisdom say?<br>
<br>
My current thought is to do a UDP check (don't change timeout/retry from<br>
default) and only if that fails - retry immediately with a TCP Check.<br>
Others in my group are for using TCP immediately.<br>
<br>
--<br>
. . ___. .__ Posix Systems - Sth Africa. e.164 VOIP ready<br>
/| /| / /__ <a href="mailto:mje@posix.co.za">mje@posix.co.za</a> - Mark J Elkins, Cisco CCIE<br>
/ |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496<br>
<br>
_______________________________________________<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
</blockquote></div><br><br clear="all"><br><br>