<div dir="ltr">Also, if I send the command "rndc notify <a href="http://sdxlive.com">sdxlive.com</a>" on the primary, I get in the logs:<div><u>on the <b>primary</b></u>:</div><div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>17-Oct-2019 11:08:46.047 general: info: received control channel command 'notify <a href="http://sdxlive.com">sdxlive.com</a>'<br>17-Oct-2019 11:08:46.053 notify: info: zone <a href="http://sdxlive.com/IN">sdxlive.com/IN</a> (signed): sending notifies (serial 2019101614)<br></div></blockquote><u>on the <b>secondary</b></u>:</div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>nothing happens since it already has that version.</div></blockquote></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Oct 17, 2019 at 11:06 AM jean-christophe manciot <<a href="mailto:actionmystique@gmail.com">actionmystique@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">However, if I increment the serial number (SN) on the primary from 2019101614 to 2019101709 and order a retransfer on the secondary with "rndc retransfer <a href="http://sdxlive.com" target="_blank">sdxlive.com</a>", I get in the logs:<div><u>on the <b>primary</b></u>:</div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><i>17-Oct-2019 10:56:09.038 xfer-out: info: client @0xcccccccccccc a.b.c.d#49155 (<a href="http://sdxlive.com" target="_blank">sdxlive.com</a>): transfer of '<a href="http://sdxlive.com/IN" target="_blank">sdxlive.com/IN</a>': AXFR started (serial 2019101614)</i></div><div><i>17-Oct-2019 10:56:09.039 xfer-out: info: client @0xcccccccccccc a.b.c.d#49155 (<a href="http://sdxlive.com" target="_blank">sdxlive.com</a>): transfer of '<a href="http://sdxlive.com/IN" target="_blank">sdxlive.com/IN</a>': AXFR ended: 1 messages, 36 records, 2906 bytes, 0.001 secs (2906000 bytes/sec)</i></div></blockquote><u>on the <b>secondary</b></u>:<div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><i>17-Oct-2019 10:55:39.015 general: info: received control channel command 'retransfer <a href="http://sdxlive.com" target="_blank">sdxlive.com</a>'<br>17-Oct-2019 10:56:09.031 general: info: zone <a href="http://sdxlive.com/IN" target="_blank">sdxlive.com/IN</a>: refresh: retry limit for master e.f.g.h#53 exceeded (source 0.0.0.0#0)<br>17-Oct-2019 10:56:09.031 general: info: zone <a href="http://sdxlive.com/IN" target="_blank">sdxlive.com/IN</a>: Transfer started.<br>17-Oct-2019 10:56:09.033 xfer-in: info: transfer of '<a href="http://sdxlive.com/IN" target="_blank">sdxlive.com/IN</a>' from e.f.g.h#53: connected using a.b.c.d#49155<br>17-Oct-2019 10:56:09.040 general: info: zone <a href="http://sdxlive.com/IN" target="_blank">sdxlive.com/IN</a>: transferred serial 2019101614<br>17-Oct-2019 10:56:09.040 xfer-in: info: transfer of '<a href="http://sdxlive.com/IN" target="_blank">sdxlive.com/IN</a>' from e.f.g.h#53: Transfer status: success<br>17-Oct-2019 10:56:09.040 xfer-in: info: transfer of '<a href="http://sdxlive.com/IN" target="_blank">sdxlive.com/IN</a>' from e.f.g.h#53: Transfer completed: 1 messages, 36 records, 2906 bytes, 0.006 secs (484333 bytes/sec)<br>17-Oct-2019 10:56:09.040 notify: info: zone <a href="http://sdxlive.com/IN" target="_blank">sdxlive.com/IN</a>: sending notifies (serial 2019101614)</i><br></div></blockquote><div><br></div>As you can see, only the previous zone release has been transferred, not he latest SN.<br><div><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Oct 17, 2019 at 10:33 AM jean-christophe manciot <<a href="mailto:actionmystique@gmail.com" target="_blank">actionmystique@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">wow something has chewed up your message and vomited it out again but some<br>of the remnants are vaguely legible...<br></blockquote><div>I don't know what happened, but some IP addresses & other fields have been intentionally obfuscated. The original first message have been attached to this answer. </div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">I'm not sure this belief is entirely solid, given what the logs said.<br></blockquote><div>The logs on the primary show no error during the transfer, although it did not occur in reality. </div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">You have to use the -j option to include any changes recorded in the<br>zone's journal, otherwise you are almost certainly looking at a stale<br>version of the zone.<br></blockquote><div>Noted.</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">* run `rndc retransfer` on the secondary<br></blockquote><div>That works, thanks. </div><div> </div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Oct 16, 2019 at 3:43 PM Tony Finch <<a href="mailto:dot@dotat.at" target="_blank">dot@dotat.at</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">jean-christophe manciot <<a href="mailto:actionmystique@gmail.com" target="_blank">actionmystique@gmail.com</a>> wrote:<br>
<br>
wow something has chewed up your message and vomited it out again but some<br>
of the remnants are vaguely legible...<br>
<br>
> - the debug log shows that the zone transfer has *successfully* taken place<br>
> on the primary towards the secondary server:<br>
><br>
> - actually, the zone transfer could not have succeeded because the port 53<br>
> was closed on the secondary server for the master<br>
<br>
I'm not sure this belief is entirely solid, given what the logs said.<br>
<br>
> - indeed, the secondary server has no knowledge of the new data:<br>
><br>
> # named-checkzone -D -f raw -o - <a href="http://sdxlive.com" rel="noreferrer" target="_blank">sdxlive.com</a> [snip]<br>
<br>
You have to use the -j option to include any changes recorded in the<br>
zone's journal, otherwise you are almost certainly looking at a stale<br>
version of the zone.<br>
<br>
If a zone is loaded and running, I usually find it is easier to use `dig<br>
axfr` (or `host -lA` if I don't want DNSSEC clutter), instead of<br>
named-compilezone, and `dig soa` instead of `named-checkzone`.<br>
<br>
You can try `nsdiff -m primary -s secondary zone` to verify that the zone<br>
files are consistent <<a href="http://www.dotat.at/prog/nsdiff/" rel="noreferrer" target="_blank">http://www.dotat.at/prog/nsdiff/</a>>, e.g.<br>
<br>
$ nsdiff -m <a href="http://pri0.dns.cam.ac.uk" rel="noreferrer" target="_blank">pri0.dns.cam.ac.uk</a> -s <a href="http://auth0.dns.cam.ac.uk" rel="noreferrer" target="_blank">auth0.dns.cam.ac.uk</a> <a href="http://cam.ac.uk" rel="noreferrer" target="_blank">cam.ac.uk</a><br>
nsdiff: loading zone <a href="http://cam.ac.uk" rel="noreferrer" target="_blank">cam.ac.uk</a>. via AXFR from <a href="http://auth0.dns.cam.ac.uk" rel="noreferrer" target="_blank">auth0.dns.cam.ac.uk</a><br>
zone <a href="http://cam.ac.uk/IN" rel="noreferrer" target="_blank">cam.ac.uk/IN</a>: loaded serial 1571232847 (DNSSEC signed)<br>
OK<br>
nsdiff: loading zone <a href="http://cam.ac.uk" rel="noreferrer" target="_blank">cam.ac.uk</a>. via AXFR from <a href="http://pri0.dns.cam.ac.uk" rel="noreferrer" target="_blank">pri0.dns.cam.ac.uk</a><br>
zone <a href="http://cam.ac.uk/IN" rel="noreferrer" target="_blank">cam.ac.uk/IN</a>: loaded serial 1571232847 (DNSSEC signed)<br>
OK<br>
$<br>
<br>
[ I'm obviously massively biased, but `nsdiff` is amazingly reassuring<br>
when you are doing big DNS provisioning infrastructure changes. ]<br>
<br>
> - whatever I try, it seems impossible to retransfer the zone data now that<br>
> the port 53 is open on the primary:<br>
<br>
You can:<br>
<br>
* run `rndc retransfer` on the secondary<br>
<br>
* run `rndc notify` on the master to maybe prompt a retransfer, depending<br>
on whether the secondaries are up to date<br>
<br>
* bump the serial on the primary again to prompt a retransfer by<br>
persuading the secondaries they are out of date<br>
<br>
A primary can't force a transfer to a secondary, it can only send the<br>
secondary a NOTIFY to suggest that the secondary might want to transfer.<br>
<br>
Tony.<br>
-- <br>
f.anthony.n.finch <<a href="mailto:dot@dotat.at" target="_blank">dot@dotat.at</a>> <a href="http://dotat.at/" rel="noreferrer" target="_blank">http://dotat.at/</a><br>
Northwest Fitzroy, Sole: Southwesterly 4 to 6, increasing 7 or gale 8. Rough<br>
or very rough becoming very rough or high. Showers. Good, occasionally poor.<br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr">Jean-Christophe</div>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr">Jean-Christophe</div>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature">Jean-Christophe</div>