<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.28.3">
</HEAD>
<BODY>
Hi Vernon,<BR>
On Thu, 2013-09-19 at 23:42 +0000, Vernon Schryver wrote:<BR>
<BR>
<BLOCKQUOTE TYPE=CITE>
<PRE>
BIND RRL has had whitelisting for trusted DNS clients that send repeated
DNS requests since early days, long before any version of BIND 9.9.4.
Look for 'exempt-clients{address_match_list};' in either the ARM that
comes with 9.9.4 or via the old link labeled "Draft text for BIND9
Administrators Reference Manual (ARM) describing DNS Response Rate
Limiting (RRL)" on the original ratelimits web page at
<A HREF="http://www.redbarn.org/dns/ratelimits">http://www.redbarn.org/dns/ratelimits</A>
[ rate-limit {
...
[ exempt-clients { address_match_list } ; ]
...
} ; ]
...
DNS clients within a view can be exempted from rate limits with
the exempt-clients clause.
</PRE>
</BLOCKQUOTE>
Thanks for the pointers, I see what I need to do now.<BR>
<BR>
<BLOCKQUOTE TYPE=CITE>
<PRE>
RRL is not recommend for recursive DNS servers, because in theory
it could squelch repeated requests from legitimate DNS clients
without caches such as some SMTP servers.
</PRE>
</BLOCKQUOTE>
<BR>
As per my previous to Evan, dealing with views, I'm on redbarn reading now, I never ran it as patches, my policy is only use official upstream sources, so my first play around was with 9.9.3.b2 I think it was.<BR>
<BR>
<BLOCKQUOTE TYPE=CITE>
<PRE>
However, I do not recall reports of significant real, as opposed to
anticipated or minor problems with RRL on recursive DNS servers. The
worst that should happen is that legitimate clients will be slowed,
such as SMTP servers (mail receivers) receiving spews of spam or SMTP
clients (mail senders) spewing spam or without required DNSBL whitelisting.
A legitimate DNS client that is squelched by RRL will time-out every
other repeated request and (with the default SLIP=2) retry with TCP.
What problems did you see with your mail system and your recursive DNS
server with RRL?
</PRE>
</BLOCKQUOTE>
<BR>
plenty of delayed mail - hostname lookup failures (mostly because of URI/DNS BL's), so it certainly works as intended <IMG SRC="cid:1379640222.6551.16.camel@tardis" ALIGN="middle" ALT=":)" BORDER="0"><BR>
I will play around with views here over next day or so, from previous plays, it did not take long to see the undesired results, so if its all good I'll commit it to the serves I look after<BR>
(I did not see any issues on ns1/2, only ns0 which is split views, authoritative and cache) <BR>
<BR>
Cheers<BR>
<BR>
</BODY>
</HTML>