<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=us-ascii" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.6001.19088"></HEAD>
<BODY>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial><SPAN
class=480580717-01072011>Yes, the example.us zone loads. As I mentioned,
no errors in named.log, and the statistics webserver (in named) shows example.us
as active, albeit with '-' for the serial number instead of the number in the
zone file.</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial><SPAN
class=480580717-01072011></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial><SPAN
class=480580717-01072011>How did you get a DNAME int<SPAN
class=480580717-01072011>o .com?</SPAN> <SPAN
class=480580717-01072011></SPAN><BR></SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial><SPAN
class=480580717-01072011>I did make example.us a zone - it is one, isn't
it? If the DNAME has to go in .us, I don't see making this scheme
work. As a practical matter, registrars will put NS records into the TLDs,
and some (with encouragement) are starting to accept DNSSEC records for the
TLDs). But I've yet to see one that provides a means for a registrant to
have a DNAME inserted... Unless I'm missing something.
Did you actually manage to do this, or is your setup working in third+-level
domains?</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial><SPAN
class=480580717-01072011></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT color=#0000ff size=2 face=Arial><SPAN
class=480580717-01072011>I was hoping/expecting that since my server is the
authoritiative server for example.us, the DNAME could go in the example.us
zone. I expected that when, as the authoritative server, it was asked for
foo.example.us, it would respond with foo.example.net. </SPAN></FONT><FONT
color=#0000ff size=2 face=Arial><SPAN class=480580717-01072011>But the RFC
wasn't clear, which is why I asked.</SPAN></FONT></DIV>
<DIV><FONT color=#0000ff size=2 face=Arial></FONT> </DIV>
<DIV><SPAN class=480580717-01072011><FONT color=#0000ff size=2
face=Arial>thanks.</FONT></SPAN></DIV><!-- Converted from text/plain format -->
<P><FONT
size=2>---------------------------------------------------------<BR>This
communication may not represent my employer's views,<BR>if any, on the matters
discussed.<BR> </FONT> </P>
<DIV><FONT color=#0000ff size=2 face=Arial></FONT> </DIV><BR>
<DIV dir=ltr lang=en-us class=OutlookMessageHeader align=left>
<HR tabIndex=-1>
<FONT size=2 face=Tahoma><B>From:</B> Jon F. [mailto:pikel.m95@gmail.com]
<BR><B>Sent:</B> Thursday, June 30, 2011 16:11<BR><B>To:</B> Timothe
Litt<BR><B>Cc:</B> bind-users@lists.isc.org<BR><B>Subject:</B> Re:
DNAME?<BR></FONT><BR></DIV>
<DIV></DIV>I have a similar set up to that and it works. Have you checked the
logs to make sure the zone properly loaded? I'm assuming the zone data you
posted below is from the <A href="http://example.us">example.us</A> zone but
your first question makes it sound like you put it in a seperate zone. That
would explain the SERVFAIL if the zone data never loaded but the server was
authoritative. It does need to be in the .us.<BR><BR><BR>;; ANSWER
SECTION:<BR><A
href="http://example.com">example.com</A>.
60 IN
DNAME <A href="http://example.net">example.net</A>.<BR><A
href="http://test.example.com">test.example.com</A>.
60 IN
CNAME <A href="http://test.example.net">test.example.net</A>.<BR><A
href="http://test.example.net">test.example.net</A>.
60 IN
A 127.0.0.1<BR><BR><BR><BR>And that's with
zone data like this:<BR><A href="http://example.com">example.com</A>. IN
NS <A href="http://ns1.example.net">ns1.example.net</A>.<BR><A
href="http://example.com">example.com</A>. IN NS <A
href="http://ns2.example.net">ns2.example.net</A>.<BR><A
href="http://example.com">example.com</A>. IN A 10.0.0.1<BR><A
href="http://example.com">example.com</A>. IN DNAME <A
href="http://example.net">example.net</A>.<BR><BR><BR>Truthfully I haven't
looked at DNAME's in a long time so I'm unsure how to do it fully for a domain
without adding an A record as well. But what your doing works, it's just not
very pretty. Someone may have a better way.<BR><BR><BR><BR>
<DIV class=gmail_quote>On Thu, Jun 30, 2011 at 2:01 PM, Timothe Litt <SPAN
dir=ltr><<A href="mailto:litt@acm.org">litt@acm.org</A>></SPAN> wrote:<BR>
<BLOCKQUOTE
style="BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex; PADDING-LEFT: 1ex"
class=gmail_quote>I have domain <A href="http://example.net"
target=_blank>example.net</A> in production, and have recently acquired<BR><A
href="http://example.us" target=_blank>example.us</A> and <A
href="http://example.info" target=_blank>example.info</A>.<BR><BR>For whatever
reason, I want <A href="http://example.us" target=_blank>example.us</A> to
simply mirror <A href="http://example.net" target=_blank>example.net</A>,
which<BR>is dynamically udpdated (and dnssec). And I want <A
href="http://example.us" target=_blank>example.us</A> to be
zero<BR>maintenance. (Well, OK I know I need separate DNSSEC keys, but I don't
want<BR>to mirror every update made in .net to .us)<BR><BR>So, I add a zone to
<A href="http://ns1.example.net" target=_blank>ns1.example.net</A> that looks
like:<BR>(In view "internal")<BR> zone "<A
href="http://example.us" target=_blank>example.us</A>" {<BR>
auto-dnssec maintain;<BR> type
master;<BR> allow-transfer { key "TSIG_GLOBAL_KEY";
};<BR> file "EXAMPLE_US.DB";<BR>
update-policy {<BR> grant
"TSIG_GLOBAL_KEY" subdomain <A href="http://example.us"
target=_blank>example.us</A>. ANY ;<BR> };<BR>
};<BR><BR>$ORIGIN .<BR>$TTL 600 ; 10
minutes<BR><A href="http://example.us" target=_blank>example.us</A>.
IN SOA <A
href="http://ns1.example.net" target=_blank>ns1.example.net</A>.<BR><A
href="http://examplenetadmin.example.net"
target=_blank>examplenetadmin.example.net</A>. (<BR>
2011063001 ; serial<BR>
172800
; refresh (2 days)<BR>
600
; retry (10 minutes)<BR>
2419200 ; expire (4 weeks)<BR>
600 ; minimum (10 minutes)<BR>
)<BR><A href="http://example.us"
target=_blank>example.us</A>. IN DNAME <A
href="http://example.net" target=_blank>example.net</A>.<BR><A
href="http://example.us" target=_blank>example.us</A>. IN NS <A
href="http://ns1.example.net" target=_blank>ns1.example.net</A>.<BR><A
href="http://example.us" target=_blank>example.us</A>. IN NS <A
href="http://ns2.example.net" target=_blank>ns2.example.net</A>.<BR><BR>I get
SERVFAIL with dig if I ask about, say <A href="http://www.example.us"
target=_blank>www.example.us</A> @<A href="http://ns1.example.net"
target=_blank>ns1.example.net</A><BR>(<A href="http://www.example.net"
target=_blank>www.example.net</A> does exist).<BR><BR>I see nothing in the
named.log, except the trace 99 /notrace commands<BR>bracketing the dig, and if
I turn on querylog:<BR>client <ns1 IP>#33256: view internal: query: <A
href="http://www.example.us" target=_blank>www.example.us</A> IN A +
(<ns1<BR>IP>).<BR><BR>If I look at the named statistics channel, I see
that <A href="http://example.us" target=_blank>example.us</A> is
being<BR>served, but the zone serial is '-', not
'2011063001'.<BR><BR>Questions:<BR> o Am I confused
about DNAME placement - would it have to go in .US?<BR>If so, is this
possible? (I don't mean technically possible - I mean<BR>practically -
e.g. thru a registrar such as godaddy, enom, etc). If not,<BR>what
explains the SERVFAIL?<BR> o Why is '-' reported for the
zone serial?<BR> o I understand that DNAME and MX
don't play well together (DNAME is<BR>essentially CNAME, and MX doesn't
allow<BR> CNAMEs). I suspect I'd have
to live with that - unless there are<BR>wiser heads?<BR>
o Is there a better approach? (Assume that I'll also want to do
the<BR>same thing to
example.info...)<BR><BR>Thanks.<BR><BR>---------------------------------------------------------<BR>This
communication may not represent my employer's views,<BR>if any, on the matters
discussed.<BR><BR><BR>_______________________________________________<BR>Please
visit <A href="https://lists.isc.org/mailman/listinfo/bind-users"
target=_blank>https://lists.isc.org/mailman/listinfo/bind-users</A> to
unsubscribe from this list<BR><BR>bind-users mailing list<BR><A
href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</A><BR><A
href="https://lists.isc.org/mailman/listinfo/bind-users"
target=_blank>https://lists.isc.org/mailman/listinfo/bind-users</A><BR></BLOCKQUOTE></DIV><BR><BR
clear=all><BR>-- <BR>Jonathan French
<DIV><A href="mailto:pikel.m95@gmail.com"
target=_blank>pikel.m95@gmail.com</A></DIV><BR></BODY></HTML>