<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 2024/10/08 17:49, Otto Moerbeek
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:ZwVUhc28Q5rgvX2f@macmini.intra.drijf.net">
<pre wrap="" class="moz-quote-pre">On Tue, Oct 08, 2024 at 05:25:29PM +0200, Roland Giesler wrote:
</pre>
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">On 2024/10/08 07:43, Otto Moerbeek wrote:
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">What should I do to allow the changes onto PowerDNS?
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">allow-notify-from only works on the network, by default a secondary
zone still only allows notifies from IPs mentioned as primary (i.e.
listed in the list of IPs when doing
pdnsutil create-secondary-zone zone primary...
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">
If have tested now that if I simply recreate the zone from the GUI and I
specify both addresses (the LAN and public ip) of the master, then the
notify is accepted!
</pre>
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">So the question is: is 192.168.131.102 listed as a primary? On the
secondary use:
pdnsutil show-zone fast.za.net
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">
It is now:
# pdnsutil show-zone fast.za.net
Oct 08 17:11:50 [bindbackend] Done parsing domains, 0 rejected, 0 new, 0
removed
This zone is owned by gts
This is a Slave zone
Primaries: 197.214.119.180:53 192.168.131.102:53
</pre>
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">The Primaries list will be in the second line.
If it is not listed you might want to add it, using pdnsutil
change-secondary-zone-primary, or alternatevily use TSIG signed
notifies or list the notify source as a
<a class="moz-txt-link-freetext" href="https://docs.powerdns.com/authoritative/settings.html#trusted-notification-proxy">https://docs.powerdns.com/authoritative/settings.html#trusted-notification-proxy</a>
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">
I have listed all my primaries (Mail-in-a-box) servers as trusted proxies,
so let's see if that is sufficient.
Roland
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">
Having both addresses listed as primaries might not be needed,
depending on your setup. And *also* including the addresses in
trusted-notification-proxy sounds like extra overkill.</pre>
</blockquote>
<p>Yes, both <span style="white-space: pre-wrap">trusted-notification-proxy and multiple master ip addresses are indeed overkill. Since I don't have that many domains yet anyway, I may just recreate them all. Or just go with </span><span
style="white-space: pre-wrap">trusted-notification-proxy's... I sleep on it and make a call.</span></p>
<p><span style="white-space: pre-wrap">Thanks all</span></p>
<p><span style="white-space: pre-wrap">Roland
</span></p>
<p></p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:ZwVUhc28Q5rgvX2f@macmini.intra.drijf.net">
<pre wrap="" class="moz-quote-pre">
-Otto
</pre>
</blockquote>
</body>
</html>