<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.18.3">
</HEAD>
<BODY>
tst tst tst did you miss the Copyright notice Karl?<BR>
<BR>
The URI for that info is actually <A HREF="https://www.dns-oarc.net/oarc/services/replysizetest">https://www.dns-oarc.net/oarc/services/replysizetest</A><BR>
<BR>
<BR>
On Sun, 2010-05-02 at 14:19 +1000, Karl Kloppenborg wrote:<BR>
<BLOCKQUOTE TYPE=CITE>
Hey Noggers!
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
With the DNSSEC roll date set to 5th of may (oh look, that's in three days!)
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<B>Are you ready?</B>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<B>I was a bit bored this morning and decided to pay a visit into some of my VM's with different providers and ran some DNS Resolver tests to see how everyone was **rigging** up with DNSSEC.</B>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<B>Some interesting results :D</B>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
Operating system of VM: <B>Centos</B>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
Number of VM hosts: <B>15</B>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
Command used to test: <B>dig +short <A HREF="http://rs.dns-oarc.net">rs.dns-oarc.net</A> txt</B>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
Number of hosts who were DNSSEC ready: <B>4</B>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
Number of hosts who were NOT DNSSEC ready: <B>11</B>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
To test if your resolver is DNSSEC ready issues the following command: <B>dig +short <A HREF="http://rs.dns-oarc.net">rs.dns-oarc.net</A> txt</B>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
Your results should be along these lines:
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BLOCKQUOTE>
<PRE>
rst.x4001.rs.dns-oarc.net.
rst.x3985.x4001.rs.dns-oarc.net.
rst.x4023.x3985.x4001.rs.dns-oarc.net.
"192.168.1.1 sent EDNS buffer size 4096"
"192.168.1.1 DNS reply size limit is at least 4023 bytes"
</PRE>
</BLOCKQUOTE>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<H3>
<B><FONT SIZE="4">No EDNS</FONT></B>
</H3>
The following result comes from a DSL router that does not support EDNS:<BR>
<BR>
<BLOCKQUOTE>
<PRE>
rst.x486.rs.dns-oarc.net.
rst.x454.x486.rs.dns-oarc.net.
rst.x384.x454.x486.rs.dns-oarc.net.
"X.X.X.X DNS reply size limit is at least 486 bytes"
"X.X.X.X lacks EDNS, defaults to 512"
</PRE>
</BLOCKQUOTE>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<H3>
<B><FONT SIZE="4">IP Fragments Filtered</FONT></B>
</H3>
If you're behind a firewall that filters IP fragments, you can expect to see a reply size limit slightly less than 1400 bytes:<BR>
<BR>
<BLOCKQUOTE>
<PRE>
rst.x1014.rs.dns-oarc.net.
rst.x1202.x1014.rs.dns-oarc.net.
rst.x1382.x1202.x1014.rs.dns-oarc.net.
"X.X.X.X sent EDNS buffer size 4096"
"X.X.X.X DNS reply size limit is at least 1382 bytes"
</PRE>
</BLOCKQUOTE>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
I also tested this on a number of common modem brands including the new range of Netgear and DLINK, again a lot don't seem to be supporting DNSSEC.
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
So, what are we all doing about it? does everyone have a rollover plan?
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
Do tell :)
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<B>Cheers!</B><BR>
<B>Karl Kloppenborg</B>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
Technical Director @ Karltec
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<IMG SRC="cid:15FE21BE-D31A-46AD-81DA-592EAB115170@karltec.net" WIDTH="289" HEIGHT="95" ALIGN="bottom" BORDER="0">
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
<BR>
<BR>
<BR>
<B><I><FONT SIZE="1"><FONT COLOR="#1521f6">P</FONT></FONT></I></B><B><I><FONT SIZE="1"><FONT COLOR="#056100"> 02 8014 4253 EXT:104 | </FONT></FONT></I></B><B><I><FONT SIZE="1"><FONT COLOR="#1521f6">M </FONT></FONT></I></B><B><I><FONT SIZE="1"><FONT COLOR="#056100">0438475892 | </FONT></FONT></I></B><B><I><FONT SIZE="1"><FONT COLOR="#1521f6">www</FONT></FONT></I></B><B><I><FONT SIZE="1"><FONT COLOR="#056100">.karltec.net</FONT></FONT></I></B>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<I><FONT SIZE="1"><FONT COLOR="#056100">Please consider the environment before printing this email. Think before you print. </FONT></FONT></I>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<BR>
<BR>
</BLOCKQUOTE>
<BLOCKQUOTE TYPE=CITE>
<PRE>
_______________________________________________
AusNOG mailing list
<A HREF="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</A>
<A HREF="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</A>
</PRE>
</BLOCKQUOTE>
</BODY>
</HTML>