[Dnsmon-test] DNSMON Atlas testing for .hk
Anand Buddhdev
anandb at ripe.net
Wed Mar 19 13:50:48 CET 2014
On 19/03/2014 08:09, Ben Choy wrote:
> Dear RIPE,
>
> I see that for .hk on the old DNSMON, it tested out our b nameserver
> ok for IPv6, but on the Altas one, it say no response?
>
> Any idea?
Hi Ben,
Thanks for reporting this to us. We think we have identified the issue.
The RIPE Atlas DNS query software is currently setting the recursion
available (RA) flag in queries. This flag only makes sense in DNS
responses, and should not normally be set on queries, and DNS servers
should just ignore it in queries. However, it seems that when queried
over IPv6, b.hkirc.net.hk (or a firewall in front of it) is discarding
these queries with RA set.
We recognise this as a bug in the Atlas software, and we will fix it
with the next release. In the meantime, if you reconfigure your DNS
server or firewall to allow such queries through, then the DNSMON graph
for it will look much greener. If you do this, will you please let us
know so we can observe the DNSMON graphs for changes?
You may also choose to just leave your settings as they are, and then it
will become a test case for when the Atlas probe software is updated.
Regards,
Anand Buddhdev
RIPE NCC