26 Mar
2013
26 Mar
'13
11:07 p.m.
Hi,
Given that Google's Public DNS recently enabled DNSSEC validation:
http://googleonlinesecurity.blogspot.co.uk/2013/03/google-public-dns-now-su…
it's probably way beyond time to make some serious effort to enable
this at BitFolk.
Unbound is used here for resolvers:
http://unbound.net/
but it doesn't currently have the "validator" part enabled.
Since it is possible that there will be domains out there that have
broken DNSSEC records but nobody yet noticed (a lot less likely now
that Google's DNS validates), I don't think it would be acceptable
to just turn on validation with no notice. We're going to give you
at least 30 days of notice.
Is there anything more that you think should be done?
We could put up a test instance of Unbound with validation enabled
and you could switch to using it, to see if anything breaks. Is that
something that any of you think you would bother with?
On to logging.
Should validation failures be logged on production resolvers? On the
plus side, if you are experiencing one then you could ask us to look
in the logs to see why. On the negative side, it means we'll
casually stumble across records of tons of queries that customers
make, which is a privacy concern.
Note that if you are particularly keen on DNSSEC validation then
there's nothing stopping you installing a DNS resolver on your own
VPS today and using that.
Also that in theory enough diagnostic sites exist out there for you
to not need resolver logs.
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
27 Mar
27 Mar
10:04 a.m.
On Wed, Mar 27, 2013, at 0:07, Andy Smith wrote:
We could put up a test instance of Unbound with
validation enabled
and you could switch to using it, to see if anything breaks. Is that
something that any of you think you would bother with?
My VPS is uncritical enough that I wouldn't mind having it using an
Unbound DNSSEC test instance.
Should validation failures be logged on production
resolvers? On the
plus side, if you are experiencing one then you could ask us to look
in the logs to see why. On the negative side, it means we'll
casually stumble across records of tons of queries that customers
make, which is a privacy concern.
During a transition period, given there being an actual potential issue,
I would at least personally be ok with logging on the Bitfolk resolvers.
Now that I think about it, I'm really much more ok with logging
happening on resolvers used my VPS than I am with my home ISP
potentially having their resolvers logged. If I were to look up
something embarrassing alt misunderstandable that would most likely be
while doing regular web browsing.
// Andreas
6:06 p.m.
Hi Andreas,
On Wed, Mar 27, 2013 at 11:04:19AM +0100, Andreas Olsson wrote:
On Wed, Mar 27, 2013, at 0:07, Andy Smith wrote:
So is this something you want to happen (there to be a test
resolver), or are you happy enough just to have the production ones
cut over to being validators?
We could put up a test instance of Unbound with
validation enabled
and you could switch to using it, to see if anything breaks. Is that
something that any of you think you would bother with?
My VPS is uncritical enough that I wouldn't mind having it using an
Unbound DNSSEC test instance. During a transition period, given there being an
actual potential issue,
I would at least personally be ok with logging on the Bitfolk resolvers.
Now that I think about it, I'm really much more ok with logging
happening on resolvers used my VPS than I am with my home ISP
potentially having their resolvers logged. If I were to look up
something embarrassing alt misunderstandable that would most likely be
while doing regular web browsing.
So you are for the production resolvers logging validation failures,
at least for a limited period?
Actually looking at it the validation failures don't say the client
IP that made the query, only the failed query itself.
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
8:32 p.m.
On Wed, Mar 27, 2013, at 19:06, Andy Smith wrote:
So is this something you want to happen (there to be a
test
resolver), or are you happy enough just to have the production ones
cut over to being validators?
I'm fine either way.
That is, I'm fine with the production ones being switched anytime, but
if there initially is a test resolver I will start using that one.
So you are for the production resolvers logging
validation failures,
at least for a limited period?
Actually looking at it the validation failures don't say the client
IP that made the query, only the failed query itself.
Yepp, sounds good to me.
// Andreas
10:34 a.m.
On Tue, 26 Mar 2013 23:07:06 +0000
Andy Smith <andy(a)bitfolk.com> wrote:
Given that Google's Public DNS recently enabled
DNSSEC validation:
http://googleonlinesecurity.blogspot.co.uk/2013/03/google-public-dns-now-su…
This is something quite new to me and I wasn't even aware that google
had "Public DNS"
Personally I try to avoid having anything to do with Google, having the
opinion they are about as bad as MS in trying to take over the world
but would using those IP address 8.8.8.8 or 8.8.4.4 be beneficial.
I currently use Zens's DNS servers (as they are my ISP) with
the Bitfolk ones as alternatives and haven't had any problems to date.
I don't know enough to be able to make any comment on Andy's
question: -
Is there anything more that you think should be done?
--
John Lewis
Debian & the GeneWeb genealogical data server
6:07 p.m.
Hi John,
On Wed, Mar 27, 2013 at 10:34:25AM +0000, john lewis wrote:
I currently use Zens's DNS servers (as they are my
ISP) with
the Bitfolk ones as alternatives and haven't had any problems to date.
On your VPS? That doesn't really make sense and I'm surprised that
Zen even lets you do so from your VPS.
Perhaps I have misunderstood you.
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
6:24 p.m.
On Wed, 27 Mar 2013 18:07:55 +0000
Andy Smith <andy(a)bitfolk.com> wrote:
Hi John,
On Wed, Mar 27, 2013 at 10:34:25AM +0000, john lewis wrote:
my local /etc/resolvconf/resolv.conf.d/base has zen and bitfolk dns IPs
listed.
I haven't installed resolvconf on my VPS so /etc/resolv.conf on startx
has both bitfolk dns IPs and one of the zen IPs. There have been no
complaints.
--
John Lewis
Debian & the GeneWeb genealogical data server
I currently use Zens's DNS servers (as they
are my ISP) with
the Bitfolk ones as alternatives and haven't had any problems to
date.
On your VPS? That doesn't really make sense and I'm surprised that
Zen even lets you do so from your VPS.
6:35 p.m.
Hi John,
On Wed, Mar 27, 2013 at 06:24:30PM +0000, john lewis wrote:
I haven't installed resolvconf on my VPS so
/etc/resolv.conf on startx
has both bitfolk dns IPs and one of the zen IPs. There have been no
complaints.
Unfortunately that just doesn't work. You can't use Zen's resolvers
from outside of Zen. The packets will just be dropped by Zen and
your VPS will only be using the resolvers that work, i.e. the
BitFolk ones.
You probably haven't noticed because nothing is logged. All you'd
see would be the occasional slow connection when your VPS chooses a
non-working resolver first time.
It would be best to remove the non-BitFolk resolver IPs from your
/etc/resolv.conf, unless you have verified that they work. In
general you'd need a good reason for using any resolvers other than
the BitFolk ones, as even if they work, non-local ones would be
slower (more latency).
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
7:42 p.m.
On Wed, 27 Mar 2013 18:35:02 +0000
Andy Smith <andy(a)bitfolk.com> wrote:
It would be best to remove the non-BitFolk resolver
IPs from your
/etc/resolv.conf, unless you have verified that they work. In
general you'd need a good reason for using any resolvers other than
the BitFolk ones, as even if they work, non-local ones would be
slower (more latency).
OK, I have edited /etc/resolv.conf and left just the two bitfolk IPs
--
John Lewis
Debian & the GeneWeb genealogical data server
7:01 p.m.
Hi John,
On Wed, March 27, 2013 6:24 pm, john lewis wrote:
my local /etc/resolvconf/resolv.conf.d/base has zen
and bitfolk dns IPs
listed.
I'd be surprised if the Bitfolk resolvers will respond to recursive
requests from your home IP address. Have you actually tried it?
I haven't installed resolvconf on my VPS so
/etc/resolv.conf on startx
has both bitfolk dns IPs and one of the zen IPs. There have been no
complaints.
I dare say there probably haven't been any successfull lookups from Zen
either! It is rare for such resolvers to accept off-net recursive queries.
Mathew
7:41 p.m.
Hello,
On Wed, Mar 27, 2013 at 07:01:59PM -0000, Mathew J. Newton wrote:
On Wed, March 27, 2013 6:24 pm, john lewis wrote:
Oh, I didn't even spot that "local" might mean "not on my VPS".
Indeed, BitFolk's resolvers aren't available outside of BitFolk, so
this won't be working either.
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
my local /etc/resolvconf/resolv.conf.d/base has
zen and bitfolk dns IPs
listed.
I'd be surprised if the Bitfolk resolvers will respond to recursive
requests from your home IP address. Have you actually tried it?
7:46 p.m.
On Wed, 27 Mar 2013 19:41:27 +0000
Andy Smith <andy(a)bitfolk.com> wrote:
Hello,
On Wed, Mar 27, 2013 at 07:01:59PM -0000, Mathew J. Newton wrote:
Duh! shows just how little I know about resolving IP addresses. Have
now edited my local resolvconf.
--
John Lewis
Debian & the GeneWeb genealogical data server
On Wed, March 27, 2013 6:24 pm, john lewis
wrote:
Oh, I didn't even spot that "local" might mean "not on my VPS".
Indeed, BitFolk's resolvers aren't available outside of BitFolk, so
this won't be working either. my local /etc/resolvconf/resolv.conf.d/base has
zen and bitfolk
dns IPs listed.
I'd be surprised if the Bitfolk resolvers will respond to recursive
requests from your home IP address. Have you actually tried it? 
7:07 p.m.
Please excuse my ignorance, but I have to admit that I don't really
understand the question.
I have a VPS running Debian squeeze, and it runs bind9 to do some simple
DNS serving for a couple of domain names.
Do I need to make any changes to use DNSSEC? Should I replace bind9
with unbound? Will things break for me if you turn on this validation
thingy and I haven't made appropriate changes?
cheers
Chris
--
Chris Dennis cgdennis(a)btinternet.com
Fordingbridge, Hampshire, UK
8:09 p.m.
Hi Chris,
On Wed, Mar 27, 2013 at 07:07:56PM +0000, Chris Dennis wrote:
I have a VPS running Debian squeeze, and it runs bind9
to do some
simple DNS serving for a couple of domain names.
This is about BitFolk's resolvers, the things you put in
/etc/resolv.conf in order to resolve host names to IP addresses and
so on. It's nothing to do with any DNS server you might be running
yourself to provide authoritative DNS service for your domain(s).
Do I need to make any changes to use DNSSEC?
No; after DNSSEC validation is enabled, if a domain has DNSSEC
enabled but it's broken you will get SERVFAIL back (and no DNS
answers).
This is a deliberately-broken domain:
$ dig -t a www.dnssec-failed.org
; <<>> DiG 9.6-ESV-R4 <<>> -t a www.dnssec-failed.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 2300
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;www.dnssec-failed.org. IN A
;; Query time: 162 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Wed Mar 27 20:03:16 2013
;; MSG SIZE rcvd: 39
Without a validating resolver:
$ dig -t a www.dnssec-failed.org
; <<>> DiG 9.7.3 <<>> -t a www.dnssec-failed.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24931
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 5, ADDITIONAL: 0
;; QUESTION SECTION:
;www.dnssec-failed.org. IN A
;; ANSWER SECTION:
www.dnssec-failed.org. 7200 IN A 69.252.208.135
www.dnssec-failed.org. 7200 IN A 69.252.216.215
;; AUTHORITY SECTION:
dnssec-failed.org. 7200 IN NS dns105.comcast.net.
dnssec-failed.org. 7200 IN NS dns101.comcast.net.
dnssec-failed.org. 7200 IN NS dns102.comcast.net.
dnssec-failed.org. 7200 IN NS dns103.comcast.net.
dnssec-failed.org. 7200 IN NS dns104.comcast.net.
;; Query time: 91 msec
;; SERVER: 85.119.80.232#53(85.119.80.232)
;; WHEN: Wed Mar 27 20:02:42 2013
;; MSG SIZE rcvd: 187
Should I replace bind9 with unbound?
No; Unbound is not an authoritative nameserver, it's a resolver
(only).
If you for some reason wanted to run your own resolver instead of
using the BitFolk ones then you might install it.
I suggested that people could install it if they liked, because some
people are keen to have a DNSSEC validating resolver faster than I
am willing to enable it on the BitFolk ones.
Will things break for me if you turn on this
validation thingy and
I haven't made appropriate changes?
Yes, no: There are no changes for you to make.
A non-zero number of domain names on the Internet are bound to have
enabled DNSSEC incorrectly, so there will be some degree of breakage
which will be confusing for some people, as they will be unable to
replicate that breakage with non-validating resolvers.
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
I'd be interested to hear any (even two word)
reviews of their sofas…
Provides seating. — Andy Davidson
8:18 p.m.
I'm happy to go with the change and with the logging of fails and if a test
resolver were set up, I'd change over to that
On 27 March 2013 20:09, Andy Smith <andy(a)bitfolk.com> wrote:
Hi Chris,
On Wed, Mar 27, 2013 at 07:07:56PM +0000, Chris Dennis wrote:
--
Keith Williams
Keith's Place www.keiths-place.co.uk
Tailor Made English www.tmenglish.org
West Norfolk RSPCA www.westnorfolkrspca.org.uk
I have a VPS running Debian squeeze, and it runs
bind9 to do some
simple DNS serving for a couple of domain names.
This is about BitFolk's resolvers, the things you put in
/etc/resolv.conf in order to resolve host names to IP addresses and
so on. It's nothing to do with any DNS server you might be running
yourself to provide authoritative DNS service for your domain(s).
Do I need to make any changes to use DNSSEC?
No; after DNSSEC validation is enabled, if a domain has DNSSEC
enabled but it's broken you will get SERVFAIL back (and no DNS
answers).
This is a deliberately-broken domain:
$ dig -t a www.dnssec-failed.org
; <<>> DiG 9.6-ESV-R4 <<>> -t a www.dnssec-failed.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 2300
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;www.dnssec-failed.org. IN A
;; Query time: 162 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Wed Mar 27 20:03:16 2013
;; MSG SIZE rcvd: 39
Without a validating resolver:
$ dig -t a www.dnssec-failed.org
; <<>> DiG 9.7.3 <<>> -t a www.dnssec-failed.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24931
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 5, ADDITIONAL: 0
;; QUESTION SECTION:
;www.dnssec-failed.org. IN A
;; ANSWER SECTION:
www.dnssec-failed.org. 7200 IN A 69.252.208.135
www.dnssec-failed.org. 7200 IN A 69.252.216.215
;; AUTHORITY SECTION:
dnssec-failed.org. 7200 IN NS dns105.comcast.net.
dnssec-failed.org. 7200 IN NS dns101.comcast.net.
dnssec-failed.org. 7200 IN NS dns102.comcast.net.
dnssec-failed.org. 7200 IN NS dns103.comcast.net.
dnssec-failed.org. 7200 IN NS dns104.comcast.net.
;; Query time: 91 msec
;; SERVER: 85.119.80.232#53(85.119.80.232)
;; WHEN: Wed Mar 27 20:02:42 2013
;; MSG SIZE rcvd: 187
Should I replace bind9 with unbound?
No; Unbound is not an authoritative nameserver, it's a resolver
(only).
If you for some reason wanted to run your own resolver instead of
using the BitFolk ones then you might install it.
I suggested that people could install it if they liked, because some
people are keen to have a DNSSEC validating resolver faster than I
am willing to enable it on the BitFolk ones.
Will things break for me if you turn on this
validation thingy and
I haven't made appropriate changes?
Yes, no: There are no changes for you to make.
A non-zero number of domain names on the Internet are bound to have
enabled DNSSEC incorrectly, so there will be some degree of breakage
which will be confusing for some people, as they will be unable to
replicate that breakage with non-validating resolvers.
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
I'd be interested to hear any (even two word)
reviews of their sofas…
Provides seating. — Andy Davidson
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iEYEAREDAAYFAlFTUhAACgkQIJm2TL8VSQu1swCfQoNZmXtrhX8Xro1gcJIEeQH+
ygcAoNm8Sg3TDz+zA566j3JuDRndpUiz
=HhVz
-----END PGP SIGNATURE-----
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
8:24 p.m.
Hi Keith,
On Wed, Mar 27, 2013 at 08:18:39PM +0000, Keith Williams wrote:
I'm happy to go with the change and with the
logging of fails and if a test
resolver were set up, I'd change over to that
Is a test resolver something that you require and will use?
If no one's bothered, I don't want to do it. Personally I am happy
for it just to happen.
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
8:32 p.m.
Andy,
I have thought about setting up something like this for a while, but there
are always more things to do than time to do them. If you provide test
servers I would switch to using them. The idea of test servers to begin
with as there are sure to be hiccups of some sort somewhere along the line
and who knows how many broken DNSSEC servers up the line I have been
accepting DNS data from. So yes, a very useful addition which I would use
On 27 March 2013 20:24, Andy Smith <andy(a)bitfolk.com> wrote:
Hi Keith,
On Wed, Mar 27, 2013 at 08:18:39PM +0000, Keith Williams wrote:
--
Keith Williams
Keith's Place www.keiths-place.co.uk
Tailor Made English www.tmenglish.org
West Norfolk RSPCA www.westnorfolkrspca.org.uk
I'm happy to go with the change and with the
logging of fails and if a
test
resolver were set up, I'd change over to that
Is a test resolver something that you require and will use?
If no one's bothered, I don't want to do it. Personally I am happy
for it just to happen.
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iEYEAREDAAYFAlFTVWkACgkQIJm2TL8VSQvvmQCg7IdSe6Ke4vtqpm6mhXAwzHrK
JzoAoLXkky1OQb07QZfThhXPOLOJWy2a
=/2zW
-----END PGP SIGNATURE-----
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
7:15 p.m.
On 26 March 2013 23:07, Andy Smith <andy(a)bitfolk.com> wrote:
[snip]
Since it is possible that there will be domains out there that have
broken DNSSEC records but nobody yet noticed (a lot less likely now
that Google's DNS validates), I don't think it would be acceptable
to just turn on validation with no notice. We're going to give you
at least 30 days of notice.
Is there anything more that you think should be done?
We could put up a test instance of Unbound with validation enabled
and you could switch to using it, to see if anything breaks. Is that
something that any of you think you would bother with?
On to logging.
Should validation failures be logged on production resolvers? On the
plus side, if you are experiencing one then you could ask us to look
in the logs to see why. On the negative side, it means we'll
casually stumble across records of tons of queries that customers
make, which is a privacy concern.
[snip]
How about you do a combo, in three stages (hapening on dates you advise us
of):
1. Test servers go live, with loging (we can use them and see if a
problem appears)
2. Production servers switch to validating
3. Test servers removed
--
Robert Gauld
http://www.robertgauld.co.uk
7:46 p.m.
Hi Robert,
On Wed, Mar 27, 2013 at 07:15:49PM +0000, Robert Gauld wrote:
1. Test servers go live, with loging (we can use
them and see if a
problem appears)
Is this something that you personally want to have available and
will use?
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
"I'd be happy to buy all variations of sex to ensure I got what I wanted."
— Gary Coates (talking about cabling)
8:59 p.m.
On 27 March 2013 19:46, Andy Smith <andy(a)bitfolk.com> wrote:
Hi Robert,
On Wed, Mar 27, 2013 at 07:15:49PM +0000, Robert Gauld wrote:
I think that I'd like to use the following process (but obviously don't
setup test servers just for me):
1. Change to use the test servers for about a week (I can easily change
back if there's issues)
2. Deal with any problems that arise - not expecting any (the loging
helps you if I need to ask for help from you without bogging down the
production ones).
3. Be satisfied that there's no problems and change back to using the
production servers knowing that all will be fine when you change their
config.
--
Robert Gauld
http://www.robertgauld.co.uk
1. Test servers go live, with loging (we can
use them and see if a
problem appears)
Is this something that you personally want to have available and
will use?
Cheers,
Andy
10:04 p.m.
Hello,
On Tue, Mar 26, 2013 at 11:07:06PM +0000, Andy Smith wrote:
We could put up a test instance of Unbound with
validation enabled
and you could switch to using it, to see if anything breaks. Is that
something that any of you think you would bother with?
It looks like it will be quicker to just do this than to extract a
firm desire for it out of anyone. :)
So, there's now a validating resolver on 85.119.80.243. It will
return SERVFAIL for domains with broken DNSSEC. If you want to test
DNSSEC without installing your own resolver, please use that IP (and
only that IP) in your /etc/resolv.conf, or you can issue "dig"
commands like:
$ dig -t a www.dnssec-failed.org @85.119.80.243
; <<>> DiG 9.7.3 <<>> -t a www.dnssec-failed.org
@85.119.80.243
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 12471
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;www.dnssec-failed.org. IN A
;; Query time: 1287 msec
;; SERVER: 85.119.80.243#53(85.119.80.243)
;; WHEN: Wed Mar 27 21:50:46 2013
;; MSG SIZE rcvd: 39
In a couple of days I will send an email to announce@ stating when
validation will be turned on for the production resolvers and
mentioning the existence of 85.119.80.243.
I have since discovered "val-permissive-mode: yes":
http://unbound.net/documentation/howto_turnoff_dnssec.html
so what will most likely happen is that validation will be enabled
in permissive mode right away and logs examined after a week to see
what the likely fallout will be.
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
28 Mar
28 Mar
5:11 p.m.
Reading up on DNSSEC at http://wiki.debian.org/DNSSEC, I discovered this:
$ dig test.dnssec-or-not.net TXT
which reveals that my home set-up, using UKFSN's DNS servers, is already
using DNSSEC.
cheers
Chris
--
Chris Dennis cgdennis(a)btinternet.com
Fordingbridge, Hampshire, UK
4286
days inactive
4288
days old
21 comments
7 participants
participants (7)
-
Andreas Olsson -
Andy Smith -
Chris Dennis -
john lewis -
Keith Williams -
Mathew J. Newton -
Robert Gauld