[dns-operations] What happend to UM?

Mark Andrews Mark_Andrews at isc.org
Sun Jul 15 22:47:31 UTC 2007


> The root looks harmless enough
> 
> ; <<>> DiG 9.4.0b4 <<>> -t any um @a.root-server.net
> ; (1 server found)
> ;; global options:  printcmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2644
> ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 3, ADDITIONAL: 3
> ;; WARNING: recursion requested but not available
> 
> ;; QUESTION SECTION:
> ;um.                            IN      ANY
> 
> ;; AUTHORITY SECTION:
> um.                     172800  IN      NS      NS.ISI.EDU.
> um.                     172800  IN      NS      VENERA.ISI.EDU.
> um.                     172800  IN      NS      NS.UU.NET.
> 
> ;; ADDITIONAL SECTION:
> NS.UU.NET.              172800  IN      A       137.39.1.3
> NS.ISI.EDU.             172800  IN      A       128.9.128.127
> VENERA.ISI.EDU.         172800  IN      A       128.9.176.32
> 
> ;; Query time: 141 msec
> ;; SERVER: 198.41.0.4#53(198.41.0.4)
> ;; WHEN: Sun Jul 15 22:43:43 2007
> ;; MSG SIZE  rcvd: 136
> 
> 
> but that is interesting
> 
> ;; Truncated, retrying in TCP mode.
> 
> ; <<>> DiG 9.4.0b4 <<>> -t any um @NS.ISI.EDU
> ; (1 server found)
> ;; global options:  printcmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50126
> ;; flags: qr aa rd; QUERY: 1, ANSWER: 13, AUTHORITY: 4, ADDITIONAL: 3
> ;; WARNING: recursion requested but not available
> 
> ;; QUESTION SECTION:
> ;um.                            IN      ANY
> 
> ;; ANSWER SECTION:
> um.                     86400   IN      NS      ns.isi.edu.
> um.                     86400   IN      NS      flag.ep.net.
> um.                     86400   IN      NS      unldns.unl.edu.
> um.                     86400   IN      NS      berkeley.ip4.int.
> um.                     86400   IN      NSEC    *.um. NS SOA RRSIG NSEC DNSKE
> Y
> um.                     86400   IN      DNSKEY  256 3 5 ...
> um.                     86400   IN      DNSKEY  257 3 5 ...
> um.                     86400   IN      RRSIG   DNSKEY 5 1 ...
> um.                     86400   IN      RRSIG   DNSKEY 5 1 ...
> um.                     86400   IN      RRSIG   NSEC 5 1 ...
> um.                     86400   IN      RRSIG   NS 5 1 ...
> um.                     86400   IN      RRSIG   SOA 5 1 ...
> um.                     86400   IN      SOA     flag.ep.net. hostmaster.nic.u
> m. 2006120115 43200 3600 1209600 86400
> 
> ;; AUTHORITY SECTION:
> um.                     86400   IN      NS      ns.isi.edu.
> um.                     86400   IN      NS      flag.ep.net.
> um.                     86400   IN      NS      unldns.unl.edu.
> um.                     86400   IN      NS      berkeley.ip4.int.
> 
> ;; ADDITIONAL SECTION:
> ns.isi.edu.             86400   IN      A       128.9.128.127
> flag.ep.net.            169084  IN      A       198.32.4.13
> berkeley.ip4.int.       86400   IN      A       204.61.208.98
> 
> ;; Query time: 265 msec
> ;; SERVER: 128.9.128.127#53(128.9.128.127)
> ;; WHEN: Sun Jul 15 22:48:55 2007
> ;; MSG SIZE  rcvd: 3453
> 
> 
> And the timestamp 2006-12-01

	Peter,
	        the SOA record does not have timestamp in it.  It
	has a serial number and as long as it has moved forward
	that is all that matters for the serial.

	The three servers list in the root are consistant w.r.t.
	plain DNS.  The fourth server (unldns.unl.edu, only listed
	in the um zone) isn't configured to serve UM.

% dig +nssearch um 
SOA flag.ep.net. hostmaster.nic.um. 2006120115 43200 3600 1209600 86400 from server ns.isi.edu in 160 ms.
SOA flag.ep.net. hostmaster.nic.um. 2006120115 43200 3600 1209600 86400 from server berkeley.ip4.int in 200 ms.
SOA flag.ep.net. hostmaster.nic.um. 2006120115 43200 3600 1209600 86400 from server flag.ep.net in 194 ms.
% 

% dig soa um @unldns.unl.edu +norec

; <<>> DiG 9.3.4 <<>> soa um @unldns.unl.edu +norec
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 6483
;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;um.                            IN      SOA

;; Query time: 250 msec
;; SERVER: 129.93.1.1#53(129.93.1.1)
;; WHEN: Mon Jul 16 08:36:16 2007
;; MSG SIZE  rcvd: 20

	Also of the 3 servers listed in the root only one of them
	is DNSSEC enabled.

	ns.isi.edu is running BIND 8.3.3 so it needs to be upgraded.
	berkeley.ip4.int is running BIND 9.3.1 so it needs dnssec to be
	enabled.

% dig +nssearch um +dnssec
SOA flag.ep.net. hostmaster.nic.um. 2006120115 43200 3600 1209600 86400 from server ns.isi.edu in 162 ms.
SOA flag.ep.net. hostmaster.nic.um. 2006120115 43200 3600 1209600 86400 from server flag.ep.net in 200 ms.
RRSIG SOA 5 1 86400 20070810143321 20070711143321 64982 um. BCEiaDmJH8KAnIBeGze3Eu45jo+LQ2Cy2ahX9kefZzL34pH8kJfYV66z 71dpkQ0Eeen7F1hvNfoVY/nEbW5zAOx9pOWlRUzK5kfpL8hws8wl5Rbp eVgJONIa1SvyXM4MmDEdRukvkIdCWpWR/GGWie3E0mgqTbMNW0pRtkzN msQwjf6o/mBuv1A3dgls3F9o/6YixYQqb1XFK7FtHIGtgYuTRRL6miH4 mylGlQxPyxlRBUL9Z08vlgWddwGZSLRW8CCqD0N/9oPBntYWp/7PQjjx yEFm93AkGp+AvcYUbJsq+6wluOtFgZ3NeSZPAVSq/8p7siKExa201Pba uUtzNnaNIAP8Jm2QtHkLM7mnvEtSg2BEIeQZTqwxvkO3baz7mWXBHDME RjD0JInlhAjPbH3wh/94TGwF2Gu8s1bYEWyH7TOAboVRp+TLw3fs/EUN QfAUX/mNguQ1Ag4DnF0xMA+fV4j7DAEuEAjLomQ6YBMP495daeA+i9iw SK0xMUZnuaR5S+T2djK49WiW4IsCR+sHgNHGL59JB3Hcf0D00uLcmag= from server flag.ep.net in 201 ms.
SOA flag.ep.net. hostmaster.nic.um. 2006120115 43200 3600 1209600 86400 from server berkeley.ip4.int in 201 ms.
% 

	Mark

> I dont remember they har any RRSIG records that early
> 
> 
> Cheers
> Peter and Karin
> 
> -- 
> Peter and Karin Dambier
> Cesidian Root - Radice Cesidiana
> Rimbacher Strasse 16
> D-69509 Moerlenbach-Bonsweiher
> +49(6209)795-816 (Telekom)
> +49(6252)750-308 (VoIP: sipgate.de)
> mail: peter at peter-dambier.de
> mail: peter at echnaton.arl.pirates
> http://iason.site.voila.fr/
> https://sourceforge.net/projects/iason/
> http://www.cesidianroot.com/
> 
> _______________________________________________
> dns-operations mailing list
> dns-operations at lists.oarci.net
> http://lists.oarci.net/mailman/listinfo/dns-operations
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: Mark_Andrews at isc.org



More information about the dns-operations mailing list