Re: SIG(0) checks quota reached ?

Ondřej Surý <[email protected]> Sun, 28 Sep 2025 17:27:29 +0200
Newsgroups	gmane.network.dns.bind9.user
Message-ID	<254BD435-0DC5-4E9D-A019-E609908C1ADD__5984.30288243748$1759073282$gmane$org@isc.org>
Hi,

SIG(0) was completely disabled in BIND 9.18.28: https://bind9.readthedocs.io/en/v9.18.28/notes.html#notes-for-bind-9-18-28,
so I am wondering what "without errors means" if you actually have upgraded your BIND 9 installation in Debian bookworm

In BIND 9.20.7, a configurable limit was introduced: https://bind9.readthedocs.io/en/v9.20.13/notes.html#notes-for-bind-9-20-7

Ondrej
--
Ondřej Surý (He/Him)
[email protected]

My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours.

> On 28. 9. 2025, at 16:57, vom513 <[email protected]> wrote:
> 
> Hello all,
> 
> I just upgraded one of my machines (well fresh install to be exact…) from Debian 12 -> 13.
> 
> It’s now running BIND 9.20.11 (Debian package).
> 
> I have a few clients that use nsupdate to push changes to some dynamic zones.  This has gone through with 0 errors for years.  
> 
> This morning on one of the scheduled / triggered runs, my email from cron showed that the client was reporting “REFUSED” by my server.  However it seems like the update went through anyway ?  And right before it is the message in the Subject:
> 
> (Some names and IPs sanitized…)
> 
> 2025-09-28T01:30:01.292235-04:00 orbital named[772]: client @0x7f9d7b9ca000 2001:db8::f95f:e6ff:4175:b720#51993: SIG(0) checks quota reached
> 2025-09-28T01:30:01.293436-04:00 orbital named[772]: client @0x7f9d7eb2a000 2001:db8::f95f:e6ff:4175:b720#38198/key vom.example.com: updating zone 'example.com/IN': deleting rrset at 'ice.example.com' AAAA
> 2025-09-28T01:30:01.293519-04:00 orbital named[772]: client @0x7f9d7eb2a000 2001:db8::f95f:e6ff:4175:b720#38198/key vom.example.com: updating zone 'example.com/IN': adding an RR at 'ice.example.com' AAAA 2001:db8::f95f:e6ff:4175:b720
> 2025-09-28T01:30:01.293590-04:00 orbital named[772]: client @0x7f9d7eb2a000 2001:db8::f95f:e6ff:4175:b720#38198/key vom.example.com: updating zone 'example.com/IN': deleting rrset at 'area51.example.com' AAAA
> 2025-09-28T01:30:01.293642-04:00 orbital named[772]: client @0x7f9d7eb2a000 2001:db8::f95f:e6ff:4175:b720#38198/key vom.example.com: updating zone 'example.com/IN': adding an RR at 'area51.example.com' AAAA 2001:db8::20c:29ff:fe22:ef06
> 2025-09-28T01:30:01.293694-04:00 orbital named[772]: client @0x7f9d7eb2a000 2001:db8::f95f:e6ff:4175:b720#38198/key vom.example.com: updating zone 'example.com/IN': deleting rrset at 'truenas.example.com' AAAA
> 2025-09-28T01:30:01.293762-04:00 orbital named[772]: client @0x7f9d7eb2a000 2001:db8::f95f:e6ff:4175:b720#38198/key vom.example.com: updating zone 'example.com/IN': adding an RR at 'truenas.example.com' AAAA 2001:db8::207:43ff:fe29:580
> 
> Based on the timestamps it certainly looks related.  What does this mean ?
> 
> Thanks.
> -- 
> Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list.

-- 
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list.
signature.asc (application/pgp-signature, 963 B)