Forgot your password?
Close
typodupeerror

Comment Observations from Comcast's DNS Team (Score 5, Informative) 349

by jlivingood (#46458331) Attached to: Crowdsourcing Confirms: Websites Inaccessible on Comcast
Hi - Jason from Comcast's DNS team here. First off, we have a nifty website @ http://dns.comcast.net/ where you can check our cache and find a form to contact us directly. Let's breakdown the issues with www.021yy.org. 1 - Sub-optimal TTL: The DNS admin is not doing themselves any favors; the TTL for www.021yy.org seems to be set to 60 seconds. That will cause recursion every 60 seconds or less from US-based DNS servers to authoritative servers in China. I recommend a more industry standard TTL to enhance cacheability of these records and minimize global recursions at this frequency. I would suggest no less that 5 minutes (300 seconds in the DNS record) or even as much as 1 hour which is usually fine (3600). 2 - Auth servers seem to be in China? If you expect many users of www.021yy.org in the US, you may want to add at least one authoritative name server in the US so that when recursion does need to occur that it is faster than US-to-China transit time. 3 - Are the auth servers responsive? I get NXDOMAIN responses when asking several recursive servers, such as Google's. Macintosh-3:~ jason$ dig @8.8.8.8 021yy.org ns ; > DiG 9.8.3-P1 > @8.8.8.8 021yy.org ns ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER> DiG 9.8.3-P1 > @8.8.8.8 slashdot.org ns ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER- opcode: QUERY, status: NOERROR, id: 26387 ;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;slashdot.org. IN NS ;; ANSWER SECTION: slashdot.org. 19088 IN NS ns2.p03.dynect.net. slashdot.org. 19088 IN NS ns4.p03.dynect.net. slashdot.org. 19088 IN NS ns1.p03.dynect.net. slashdot.org. 19088 IN NS ns3.p03.dynect.net. ;; Query time: 17 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Tue Mar 11 17:42:38 2014 ;; MSG SIZE rcvd: 116 In any case, we're flushing our cache right now just in case but I am not sure that will solve a deeper DNS issue with the authoritative DNS service for this domain.

Submission + - Comcast migrating customers to DNSSEC resolvers

Submitted by ctg1701
ctg1701 writes: Starting today we will begin migrating customers who have opted out of our Domain Helper service over to our production DNSSEC-validating servers. This will happen first in a selected part of our Virginia network, and will later expand to all markets in the following sixty days, at which point all of our customers who have opted out of Domain Helper will be migrated. After this has been completed, we will migrate the rest of our customers, which we anticipate will stretch into the early part of 2011. You can find more information at http://www.dnssec.comcast.net/ and you can see an informational video at http://www.dnssec.comcast.net/dnssec-video.htm.
Communications

Comcast Launches First Public US Trial of DNSSEC 100

Posted by kdawson from the am-who-i-am-because-i-say-so dept.
cryan7755 and netbuzz both sent along a NetworkWorld story on Comcast's public test deployment of DNSSEC. Here is the company's blog post announcing the trial. "Comcast this morning announced what is believed to be the first public test deployment of DNS Security Extensions. The company says it has deployed DNSSEC throughout its nationwide network and will immediately make validating servers available to customers. In addition, Comcast said it would digitally sign all of its own domain names using DNSSEC by early next year. 'There is often talk about a chicken-and-egg sort of problem with DNSSEC. People don’t want to sign their own domains with DNSSEC until people are validating signatures,' says Jason Livingood, Executive Director of Internet Systems Engineering at Comcast. 'We want to explain how we as an ISP have a roadmap for validating signatures with DNSSEC.'"

Comment Re:Method? (Score 3, Informative) 352

by jlivingood (#28962521) Attached to: Comcast the Latest ISP To Try DNS Hijacking
First off, port 53 is NOT being redirected. Use your choice of port 53 provider - whether your own DNS, Level 3, OpenDNS, whatever. As for how it works, check out http://networkmanagement.comcast.net/DomainHelperLogic.htm and http://tools.ietf.org/html/draft-livingood-dns-redirect-00 for the precise details. The second document is a complete technical description.

Slashdot Top Deals

"I've seen the forgeries I've sent out." -- John F. Haugh II (jfh@rpp386.Dallas.TX.US), about forging net news articles

Close