<div dir="auto">I would imagine "its a hoax" is code for we dont want to bother remediating.</div><br><div class="gmail_quote"><div dir="ltr">On Fri, Jan 18, 2019, 3:20 PM Warren Kumari <<a href="mailto:warren@kumari.net">warren@kumari.net</a> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div dir="ltr"><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="m_-3534179420587141833gmail_attr">On Fri, Jan 18, 2019 at 2:58 PM Ben Croswell <<a href="mailto:ben.croswell@gmail.com" target="_blank" rel="noreferrer">ben.croswell@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="auto">I would say we had one provider go as far as saying this whole flag day thing is a hoax. </div></blockquote><div><br></div><div><div class="gmail_default" style="font-family:verdana,sans-serif">That's a weird stance / position. "The whole flag day thing is [stupid|overblown|annoying|confusing|on a Friday]" are all positions I can understand - not agree with (modulo the Friday one), but at least understand. 'tis a hoax is just confusing...</div><div class="gmail_default" style="font-family:verdana,sans-serif">Flag Day been discussed at length, and presented at multiple DNS events - it seems that a DNS provider who hasn't seen any of the presentations and recognized at least one person pushing this isn't well connected to the community, and should probably be avoided...</div></div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">W</div><div class="gmail_default" style="font-family:verdana,sans-serif">P.S: Unless they think it is simply a *very* subtle, long running, widespread hoax... and now I'm wondering if I'm the patsy here :-P</div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="auto">Not sure what option there is other than voting with your wallet and moving to a different provider.</div></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="auto"><div dir="auto"><br></div><div dir="auto">May even be worth looking at 2 providers. I see DNS provider redundancy as being a huge priority after the Dyn DDoS event.</div></div><br><div class="gmail_quote"><div dir="ltr">On Fri, Jan 18, 2019, 2:50 PM Lightner, Jeffrey <<a href="mailto:JLightner@dsservices.com" target="_blank" rel="noreferrer">JLightner@dsservices.com</a> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="m_-3534179420587141833gmail-m_-5258287713703555952m_-8209102078671414473WordSection1">
<p class="MsoNormal">On checking I find that any of our domains that use Network Solutions’ Worldnic.com nameservers are reporting failures when checked.
<br>
<br>
For example this result: <a href="https://ednscomp.isc.org/ednscomp/e30c6cf0ea" rel="noreferrer noreferrer" target="_blank">
https://ednscomp.isc.org/ednscomp/e30c6cf0ea</a><br>
<br>
Other people online have posted about Network Solutions as they also saw failures.
<br>
<br>
On calling Network Solutions today they told me they are compliant despite what was reported by
<a href="https://dnsflagday.net/" rel="noreferrer noreferrer" target="_blank">https://dnsflagday.net/</a> <u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">This issue is with domains registered at Network Solutions and using their Advanced DNS (i.e. their Worldnic name servers). Other domains we have registered with them but pointing to other name servers (i.e. our own BIND servers) displayed
as compliant. <br>
<br>
When I sent them the links they saw what I saw but still claimed they are compliant. They refused to send me something in writing stating that so I suggested they reach out to ISC regarding the checker’s results if they believe they are compliant, but they
said they don’t see the need. I’ve asked them to escalate and they say they have but I suspect I’ll not hear back from them.<br>
<br>
Is there a list of known edns compliant Registrar name severs for the larger Registrars?
<br>
<br>
Is it possible the failures seen are false? If so, are there alternate edns compliance checkers that might show different responses than <a href="http://dnsflagday.net" rel="noreferrer noreferrer" target="_blank">dnsflagday.net</a>?
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><b>From:</b> bind-users <<a href="mailto:bind-users-bounces@lists.isc.org" rel="noreferrer noreferrer" target="_blank">bind-users-bounces@lists.isc.org</a>> <b>
On Behalf Of </b>Ben Croswell<br>
<b>Sent:</b> Friday, January 18, 2019 12:19 PM<br>
<b>To:</b> <a href="mailto:bind-users@lists.isc.org" rel="noreferrer noreferrer" target="_blank">bind-users@lists.isc.org</a><br>
<b>Subject:</b> Re: DNS flag day<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">I shouldn't have posted so closely to responding to the other user.<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I am not running 9.8. I was replying to them about firewalls in regards to their 9.8 issues.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Was just hoping for a statement of 9.x or greater supports the needed badvers signaling etc.<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Fri, Jan 18, 2019, 12:15 PM Victoria Risk <<a href="mailto:vicky@isc.org" rel="noreferrer noreferrer" target="_blank">vicky@isc.org</a> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<div>
<blockquote style="margin-top:5pt;margin-bottom:5pt">
<div>
<p class="MsoNormal">On Jan 18, 2019, at 9:09 AM, Ben Croswell <<a href="mailto:ben.croswell@gmail.com" rel="noreferrer noreferrer" target="_blank">ben.croswell@gmail.com</a>> wrote:<u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">Has ISC released minimum viable BIND version for flag day?<u></u><u></u></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal">Most versions of BIND authoritative servers, going back years, are EDNS compatible. Certainly ALL currently supported versions are compatible. I see you are running 9.8, which has been EOL since September, 2014. I think that is probably
fine, as far as EDNS, however.<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">The change in BIND related to DNS Flag Day is removing workarounds from resolvers, that will retry without EDNS or otherwise try to proceed even when EDNS fails. This change came in the BIND 9.13 development version, and will be in BIND
9.14, which is not yet released.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">The problem you are seeing is most likely firewall-related.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Vicky<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<blockquote style="margin-top:5pt;margin-bottom:5pt">
<div>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I looked around and couldn't find anything. <u></u><u></u></p>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer noreferrer" target="_blank">
https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org" rel="noreferrer noreferrer" target="_blank">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><u></u><u></u></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="color:black"><u></u> <u></u></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
_______________________________________________<br>
Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer noreferrer noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org" rel="noreferrer noreferrer" target="_blank">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer noreferrer noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
</blockquote></div>
_______________________________________________<br>
Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org" target="_blank" rel="noreferrer">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="m_-3534179420587141833gmail_signature">I don't think the execution is relevant when it was obviously a bad idea in the first place.<br>This is like putting rabid weasels in your pants, and later expressing regret at having chosen those particular rabid weasels and that pair of pants.<br> ---maf</div></div>
</blockquote></div>