[Dnsmon-test] DNSMON Atlas testing for .hk

Fri Mar 21 03:46:37 CET 2014

Anand,

If this is a bug, then we rather leave our setting and see if your fix in the next release does do the job.

Many thx for the response.

Benjamin Choy
Project Manager (System & Network)
Hong Kong Internet Registration Corporation Limited (HKIRC)  http://www.hkirc.hk  http://互聯網註冊.香港
Hong Kong Domain Name Registration Company Limited (HKDNR)  http://www.hkdnr.hk  http://域名註冊.香港 
Tel: +852 2319 1313 / Fax: +852 2319 2626 / Direct: +852 2319 3819 / Email: ben.choy at hkirc.hk

The information in this email is confidential and may be legally privileged. If you are not the intended recipient, please notify the sender immediately and then delete this e-mail entirely. 
You must not retain, copy, distribute or use this e-mail for any other purpose not intended by this email or disclose any of its content to others. 
The recipient should check the email and attachment for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.
PROTECT OUR ENVIRONMENT - think before printing!

-----Original Message-----
From: Anand Buddhdev [mailto:anandb at ripe.net] 
Sent: Wednesday, March 19, 2014 8:51 PM
To: Ben Choy; dnsmon-test at ripe.net
Cc: anandb at ripe.net; Ben Lee
Subject: Re: [Dnsmon-test] DNSMON Atlas testing for .hk

On 19/03/2014 08:09, Ben Choy wrote:

> Dear RIPE,
> 
> I see that for .hk on the old DNSMON, it tested out our b nameserver 
> ok for IPv6, but on the Altas one, it say no response?
> 
> Any idea?

Hi Ben,

Thanks for reporting this to us. We think we have identified the issue.
The RIPE Atlas DNS query software is currently setting the recursion available (RA) flag in queries. This flag only makes sense in DNS responses, and should not normally be set on queries, and DNS servers should just ignore it in queries. However, it seems that when queried over IPv6, b.hkirc.net.hk (or a firewall in front of it) is discarding these queries with RA set.

We recognise this as a bug in the Atlas software, and we will fix it with the next release. In the meantime, if you reconfigure your DNS server or firewall to allow such queries through, then the DNSMON graph for it will look much greener. If you do this, will you please let us know so we can observe the DNSMON graphs for changes?

You may also choose to just leave your settings as they are, and then it will become a test case for when the Atlas probe software is updated.

Regards,

Anand Buddhdev
RIPE NCC