<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div>On Mar 7, 2012, at 6:23 PM, Mark Andrews wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>Compile in +sigchase support and give it a root key.<br></div></blockquote><div><br></div><div>Evan Hunt told us (regarding +sigchase) "<span class="Apple-style-span" style="font-family: monospace; ">in its current state it's terrible and </span><span class="Apple-style-span" style="font-family: monospace; ">you really shouldn't use it."</span></div><div><font class="Apple-style-span" face="monospace"><br></font></div><div><font class="Apple-style-span" face="monospace">I'm not sure who to believe.</font></div><div><span class="Apple-style-span" style="font-family: monospace; "><br></span></div><blockquote type="cite"><div>TCP has *never* been optional for DNS. Unfortunately there are lots<br>of myths out there and your firewall administrators listened to them.<br></div></blockquote><div><br></div><div>I didn't ask about TCP. I am very aware of the various firewall holes that need to be open for DNS to work. My firewall administrator is too.</div><div><br></div><div>In this case it was inadvertently left out of our firewall, and was quickly fixed once identified.</div><div><br></div><div>The issue in this case was that *identifying* it with dig was very difficult.</div><div><br></div></div></body></html>