Hello,
On Fri, 2014-06-13 at 17:06 +0200, Bastien Durel wrote:
On 13/06/2014 12:08, Jan Kadlec wrote:
Hello Bastien,
Hello,
thanks for your report. What version of Knot do
you run?
root@corrin-2:/etc/knot# knotd --version
Knot DNS, version 1.4.6
How do you
update the master zones? Using DDNS or manually?
I update them manually
Do slaves receive IXFR
or AXFR?
They receive IXFR, but often fall back to AXFR (don't know why)
Jun 13 07:59:38 corrin knot[7981]: [notice] Incoming IXFR of
'3.d.7.2.2.0.0.0.0.d.1.4.1.0.0.2.ip6.arpa.' with '10.42.42.21@53':
Fallback to AXFR.
Jun 13 07:59:38 corrin knot[5224]: [notice] Incoming IXFR of
'8.c.3.0.8.f.6.0.1.0.0.2.ip6.arpa.' with '10.42.42.6@53': Fallback to
AXFR.
IXFR from differences (keeping track of manual changes to the zone file)
has to be explicitly turned-on in the configuration, via the
ixfr-from-differences option (it is enabled for automatic DNSSEC zones
though). We'll clarify this a bit in the documentation. If you have this
enabled, than please send me a log of these transfers from master as
well.
We have fixed a few issues in DDNS in Knot 1.4
(release imminent) and
in 1.5 DDNS is completely rewritten (changes that get to slaves via IXFR
are the same exact changes applied to zone now). If you do the changes
using actual zone file changes, I'd be nice if you could send us a few
samples of changes that caused those errors. Thanks a lot.
for example, this morning I updated
handfasting.geekwu.org, and got this
in my slave :
;; ANSWER SECTION:
handfasting.geekwu.org. 86400 IN AAAA 2001:41d0:2:2742::a78:2a2a
handfasting.geekwu.org. 86400 IN RRSIG AAAA 7 3 86400 20140711055734
20140611055734 45434
geekwu.org.
o6Y32K/UovVrGaLQXEu0D15YkzDg69j2INUeC55hzMAN5qdYbJcxZ3C+
rSyILV3KfbnNz2E+Sd8PMs+EEAtQnD0dSFdT3S6AgRtK2GO2NFVLVLSc
sHkrJzH+fxtdu+Vbh5zokf4xQvemSR7UfExSgBi8BKiuCSu+tefUdpjI OCQ=
handfasting.geekwu.org. 86400 IN RRSIG AAAA 7 3 86400 20140713070325
20140613070325 45434
geekwu.org.
U1SFjx2bAQMoY1Znx+VSsCgLpPiKJPsSPXvq3GoV2md3g7NgWtqv14RL
Xit4Ys6dO+jSTXuZmlwp2gQHjhem9+YVhhEa2geYpOYMXYV2eoyhOmxy
0L501KLYN0Mxlx83xpeqOcdvnUhgIsc4U2ATvAeWLdSdb3WfHrYKAec3 Xps=
Do non-DNSSEC records also get out of sync? In any case, we'll try to
reproduce this and give you a fix in the 1.4.7 release. In the meantime,
I'm afraid there only two options that might help: try editing the zone
file dumped by Knot (i.e. do not replace it with the newly generated
file) or run version 1.5.0rc1 on your master. I know these solutions are
far from ideal, hopefully we'll have a proper fix for your on Monday.
Regards, Jan.
Regards,