3 ms·
Presumably they are not going to remove the workarounds until the software has actually had a chance to disseminate? For example the resolvers they list are all
by eikenberry 8y ago
Presumably they are not going to remove the workarounds until the software has actually had a chance to disseminate? For example the resolvers they list are all new releases and aren't in any current Linux distro. Which means they are saying that in a couple weeks all Linux resolvers could stop resolving some domains unless they adopt an unsupported release of the resolver?
They don't list it, but presumably the same applies to the Authoritative servers. I run a pretty vanilla NSD install and it fails several tests. NLNETLABS (the authors/maintainers of nsd/unbound) is listed as a supporter, but they don't mention anything about this on their site nor does their documentation mention anything about settings to control these features.
If this will actually have the consequences they describe it was terribly mismanaged.
- wjoe 8y agoI am a bit confused about the versions they say are safe. I'm running Bind 9.11 and their tester says there are no issues, and it supports all the necessary EDNS behaviour. I think the point is that those versions mentioned will remove support for the bad behaviour, but it's not clear what you do need to do to prepare. I guess the only steps you can take are to run the tests and update to the latest version available.
- eikenberry 8y agoJust to clear the record for NSD users... I misread the results and my NSD setup (4.1.0) does pass the test. It was my secondary at buddyns.com that is having issues. I'll report the issue to them, but I'm still concerned about the supported recursive resolvers not being compliant.
- wila 8y agoThe default powerdns server in debian stable also fails. This is a reasonable common setup for DNS servers. It is a bit weird to have a server running current/stable that does not pass the test. Apparently the fix is to use the external repository from powerdns.
- detaro 8y agoThe resolvers listed are the ones that implement the new behaviour of not including the workarounds. They are not the first versions to support EDNS.