Navigatie overslaan.

dns

Gandi supports IPv6 glue records for .name

I've finally gotten IPv6 glue records for my domain. If I can trust Hurricane Electric's
IPv6 progress report
I'm the first one who has IPv6 glue records in the .name zone.
I've been trying to get IPv6 glue records for some time, but it's not easy for a .name domain if your registrar doesn't support it.

There is a trick where you use another registrar just to push the glue records, but .name is quite rare and I have not found anyone that would provide that service to me at a reasonable price.

Gandi promised a solution a while ago, but so far it didn't work for me, but now it does. Just register your DNS servers with them and add them to your domain, just like you would do with IPv4. There is one caveat; you can register only 1 IP adress per hostname. That means that you will need to add seperate records for IPv4 and IPv6. That shouldn't be problem for anyone though.

update: I celebrated to early. Even though the interface accepted the request the ipv6 glue records are not actually published. I've mailed Verisign and they promised that support for the .name domain would be re-enabled on November 7. I'm looking forward to it.

update2: It works now! http://www.gielen.name/IPv6 glue for NAME

DNSSEC made easy with zonesigner

I've just tested zonesigner from dnssec-tools.org. It was surprisingly easy. If you think that DNSSEC is a complex mess you should try zonesigner. It's pretty much as close to a turn-key solution for DNSSEC as possible. You don't really need to understand what's happening. Just follow the instructions and you'll be fine.

Adding DNSSEC to your domain is still not for everybody, but if you feel confident about administrating BIND, than DNSSEC should be within your reach as well.

Vista supposed to threaten DNS

Paul Mockapetris has written a paper in which he claims that IPV6 presents a danger to DNS. In my opinion most of this is nonsense.
He describes two problems. The first problem is that a DNS server might return an IPV6 address for a server that does not support IPV6. This is clearly a configuration error on part of the administrator, not a fundamental problem in DNS. IPV6 addresses do not magically appear in DNS, they are purposefully put their by DNS administrators. If such an administrator puts in wrong information, that his mistake. Not a problem with DNS. The same thing is true for IPV4. If the server answers an address where nobody is listening, it won't work. So unless administrators are intentionally going publish wrong information no problems should occur.
Compare this to car-navigation software that directs you to drive onto a non-existant road. This will not happen unless somebody put that non-existant road into the database. That's a human mistake, not a fundamental error.

The second problem is that your browser/OS will try to guess the proper name for non-existing names. So if you look for "hotmail", the system will try hotmail.com, www.hotmail.com, hotmail.net, www.hotmail.net, etc....
This has worked for IPV4 for twenty years. It's not a very good solution, but it's not a real problem either. Things will be exactly the same for IPV6, except that it will make more guesses before giving up.

The main problem described is the increased load on DNS servers. This is probably true for some big DNS servers, but not for the vast majority. Most DNS servers don't do much. Most of the time they are awaiting new requests, and they can instantaneously answer.
Even a tenfold increase in DNS queries will go unnoticed on most DNS servers.
It might be a problem for some big ISP's, however these guys are constantly upgrading their systems anyway. Each domain, (and therefore, each ISP) should have 2 DNS servers anyway, and even the biggest ISP's seldom have more then a handfull. Expanding that service is very straight forward, and completly built into the DNS protocol. Just add a new machine, change a few settings and your done. Nothing fancy, nothing that any admin worth his salt should have a problem with.
Even though it might not seem so at first sight, IPV6 simplifies networking a lot. ISP's can save money on routers to compensate for an increase DNS load. (Ok, I'll admit that's wishfully thinking at this moment).
A mitigating factor could be that more and more people are getting cable/adsl-modems with a built-in DNS cache. That can significantly reduce the load on the providers DNS servers.

All in all this feels like an attempt to draw attention to himself.

Inhoud syndiceren