DNS Tool

RouterOS General
1

I’m trying to set up my own BIND server and use the dns-update tool. I’m getting a BADSIG error that is mentioned in these threads. None of these threads mention a resolution. Is the dns-update tool custom to changeip.com?

http://forum.mikrotik.com/t/ddns-broke-from-mikrotik-2-9-27-to-3-22/27340/1
http://forum.mikrotik.com/t/dns-update-problem/25034/1
http://forum.mikrotik.com/t/dns-update-tool/23616/1

Thanks,
Mike

2

no, you should be able to use TSIG updates to a standard BIND server. However, I think it might be broken. I wonder if its a time sync comparision thing or something wrong with the TSIG hashing.

3

Interesting. It is not the time, as if the time is wrong I get an that error. I’m just getting invalid or unknown key on the board side and BADSIG on the server side.

Thanks,
Mike

4

How can I find out what application or executable is sending dns mx queries to my router? I’m tracing my network activity and I see a lot of dns mx queries generated on my pc towards my router, which is weird, but I don’t know how to detect the creator of all these requests. Any suggestions? Thanx a lot.

market samurai ~ marketsamurai ~ marketsamurai.com

5

BADSIG bug was fixed few versions ago.

6

I don’t know why they just don’t care about this issue but after a whole weekend I figured out what happened. I would like to share with you guys, even this is such an old thread.

  • First please confirm you generated the key with HMAC-MD5 (I have 128bit hmac-md5 tested), that’s the only supported algo by RouterOS;
    Then comes the most important part: key-name MATTERS! IT MUST BE EXACTLY SAME AS YOUR KEY NAME WHICH CONFIGURED IN BIND SERVER!

Explaination:
Usually you have some blocks in named.conf.local:

key “xxx” {
algorithm HMAC-MD5;
secret “this_is_your_tsig_md5_key”;
}
zone “test.domain.com” {

allow_update {
key “xxx”;
};
}

Then YOU MUST USE “xxx” AS THE key-name IN dns-update COMMAND.
This issue drives me crazy, hope my reply helps.