<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
G'day Bill, PLUG,<br>
<br>
>From memory iiNet are using Nominum Caching Name Servers. The dns-oarc
page has a section on Nominum CNS:<br>
<br>
...<br>
Nominum's CNS resolver is designed to utilize EDNS only after first
receiving a truncated response. To use this test with a CNS resolver,
issue the following query:
<blockquote>
<pre>$ dig tcf.rs.dns-oarc.net txt
</pre>
</blockquote>
<p>The special name "tcf" instructs the server to set the TC bit in
responses if the query doesn't have an EDNS pseudo-record. This should
cause CNS to re-query with EDNS.<br>
...<br>
</p>
Testing using this request shows that iiNet's DNS passes:<br>
<br>
a@Death:~$ dig tcf.rs.dns-oarc.net txt @203.0.178.191<br>
<br>
; <<>> DiG 9.7.0-P1 <<>> tcf.rs.dns-oarc.net
txt @203.0.178.191<br>
;; global options: +cmd<br>
;; Got answer:<br>
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7484<br>
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 0<br>
<br>
;; QUESTION SECTION:<br>
;tcf.rs.dns-oarc.net. IN TXT<br>
<br>
;; ANSWER SECTION:<br>
tcf.rs.dns-oarc.net. 60 IN CNAME tcf.x3831.rs.dns-oarc.net.<br>
tcf.x3831.rs.dns-oarc.net. 59 IN CNAME
tcf.x3837.x3831.rs.dns-oarc.net.<br>
tcf.x3837.x3831.rs.dns-oarc.net. 58 IN CNAME
tcf.x3843.x3837.x3831.rs.dns-oarc.net.<br>
tcf.x3843.x3837.x3831.rs.dns-oarc.net. 57 IN TXT "203.55.230.105 DNS
reply size limit is at least 3843"<br>
tcf.x3843.x3837.x3831.rs.dns-oarc.net. 57 IN TXT "Tested at 2010-05-03
00:52:03 UTC"<br>
<br>
;; Query time: 2648 msec<br>
;; SERVER: 203.0.178.191#53(203.0.178.191)<br>
;; WHEN: Mon May 3 08:52:03 2010<br>
;; MSG SIZE rcvd: 220<br>
<br>
Looks like you can put your tinfoil helmet away for now.<br>
<br>
Adrian<br>
<br>
On 01/05/10 17:32, William Kenworthy wrote:
<blockquote cite="mid:1272706373.9049.717.camel@rattus" type="cite">
<pre wrap="">Here is an interesting fact ... the DNS root servers are switching to
(fully, some are already using it) DNSSEC on the 5th May. The slashdot
article
(<a class="moz-txt-link-freetext"
href="http://tech.slashdot.org/firehose.pl?op=view&type=story&sid=10/04/30/1258234">http://tech.slashdot.org/firehose.pl?op=view&type=story&sid=10/04/30/1258234</a>) says some businesses with out of date hardware might be affected and gives a test site (<a
class="moz-txt-link-freetext"
href="https://www.dns-oarc.net/oarc/services/replysizetest">https://www.dns-oarc.net/oarc/services/replysizetest</a>)
A host at work was fine, but iinet from home failed for me - the
operating system/local DNS/firewalls on my side are pretty much the same
for both tests, just location and upstream differ.
slashdot is predicting the sky is falling as well as no its not,
everything will be fine as usual! - I dont know enough to say one way or
the other.
I await the 5th of may with my tinfoil helmet at the ready :)
BillK
</pre>
</blockquote>
<br>
</body>
</html>