<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On May 4, 2010, at 11:01 AM, Linux Addict wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>On Tue, May 4, 2010 at 10:43 AM, Stephane Bortzmeyer <span dir="ltr"><<a href="mailto:bortzmeyer@nic.fr">bortzmeyer@nic.fr</a>></span> wrote:</div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"> On Tue, May 04, 2010 at 10:27:25AM -0400,<br> Linux Addict <<a href="mailto:linuxaddict7@gmail.com">linuxaddict7@gmail.com</a>> wrote<br> <div class="im"> a message of 89 lines which said:<br> <br> > lacks EDNS, defaults to 512"<br> > DNS reply size limit is at least 490"<br> > "Tested at 2010-05-04 14:21:02 UTC"<br> <br> </div>You edited the responses (which includes an IP address). Is it the IP<br> address of your resolver? There is may be a forwarder which does not<br> have EDNS.<br> <br> Second possibility, a middlebox mangles your packets and deletes EDNS<br> options.<br> <br> </blockquote></div><div><br></div><div>Actually that IP was our external NAT. One information I neglected to mention is bind forwards to a tinydns appliance which of course does not support DNSSEC for obvious reasons. </div> <div><br></div><div>So what are my options now? Will the internet work for me tomorrow? At least I have company in Google..</div><div><br></div><div><div>dig +short <a href="http://rs.dns-oarc.net">rs.dns-oarc.net</a> txt @<a href="http://8.8.8.8">8.8.8.8</a></div> <div><a href="http://rst.x476.rs.dns-oarc.net">rst.x476.rs.dns-oarc.net</a>.</div><div><a href="http://rst.x485.x476.rs.dns-oarc.net">rst.x485.x476.rs.dns-oarc.net</a>.</div><div><a href="http://rst.x490.x485.x476.rs.dns-oarc.net">rst.x490.x485.x476.rs.dns-oarc.net</a>.</div> <div>"64.233.168.94 DNS reply size limit is at least 490"</div><div>"64.233.168.94 lacks EDNS, defaults to 512"</div><div>"Tested at 2010-05-04 15:00:07 UTC"</div></div><div><br></div><div><br> </div><div><br></div></blockquote><div><br></div><div>Actually, we do support EDNS0, <span class="Apple-style-span" style="font-family: arial, sans-serif; font-size: 12px; ">but usually only advertise larger buffers if needed.</span></div><div><font class="Apple-style-span" face="arial, sans-serif"><br></font></div><div><span class="Apple-style-span" style="font-family: arial, sans-serif; font-size: 12px; ">For example, if you retry this with +dnssec you should get:</span></div><div><font class="Apple-style-span" face="arial, sans-serif"><br></font></div><div><font class="Apple-style-span" face="arial, sans-serif"><div>wkumari@colon:/$ dig +dnssec +short rs.dns-oarc.net txt @8.8.8.8</div><div>rst.x1247.rs.dns-oarc.net.</div><div>rst.x1257.x1247.rs.dns-oarc.net.</div><div>rst.x1228.x1257.x1247.rs.dns-oarc.net.</div><div>"74.125.44.94 DNS reply size limit is at least 1257"</div><div>"74.125.44.94 sent EDNS buffer size 1280"</div><div>"Tested at 2010-05-05 15:51:16 UTC"</div><div>wkumari@colon:/$ </div><div><br></div></font></div><div><font class="Apple-style-span" face="arial, sans-serif"><br></font></div><div><font class="Apple-style-span" face="arial, sans-serif">W</font></div><div><br></div><br><blockquote type="cite"><div><br></div><div><br></div> _______________________________________________<br>bind-users mailing list<br><a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br><a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a></blockquote></div><br><div> <span class="Apple-style-span" style="font-size: 12px; "><div style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; "><div>--</div><div>If the bad guys have copies of your MD5 passwords, then you have way bigger problems than the bad guys having copies of your MD5 passwords.</div><div>-- Richard A Steenbergen</div></div><br class="Apple-interchange-newline"></span> </div><br></body></html>