migration from bind8 to bind9

1 msg	Marshal V Langlois is out of the office.
3 msg	Why does host Command in bind9.3.2 Repeat Itself?
5 msg	wildcard reverse lookups?
3 msg	unable to find masters list
1 msg	Ok: BIND 9.4.0rc1 is now available: Unifix Linu...
3 msg	Disabling queries over IPv6
3 msg	Secondary - SERVFAIL
5 msg	Caching nameserver
8 msg	Force Clients to always use authoritative
2 msg	rrset-order fixed not working in bind 9.4.0b4
2 msg	is this correct ?
6 msg	Resolving a domain
25 msg	Domain not resolve but resolve with other ISP d...
2 msg	Reverse Lookups from Slaves on Private Network
7 msg	NXDOMAIN returned on while updating
9 msg	nsupdate and round robin

migration from bind8 to bind9
\ Üstün Kaya (13 Dec 2006)
. \ Mark Andrews (13 Dec 2006)

1 msg	RE: BIND 9.3.3 RC3 is now available.
2 msg	Best practice for zone with resonable amount of...
6 msg	big problem - possibly dns?

Subject:	migration from bind8 to bind9
Group:	Bind-users
From:	Üstün Kaya
Date:	13 Dec 2006

Hi,
We are administrating tr. domain and testing bind9 to upgrade from
bind8. Below is a bind8 response for a sample query from one of our
currently operating DNS's:

-------------------------------------------------------------------------------- ----------------

ustun@houston:~$ dig @ns2.nic.tr milliyet.com.tr. -t ns

; <<>> DiG 9.3.2-P1 <<>> @ns2.nic.tr milliyet.com.tr. -t ns
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1229
;; flags: qr rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 2

;; QUESTION SECTION:
;milliyet.com.tr. IN NS

;; ANSWER SECTION:
milliyet.com.tr. 43200 IN NS doldns02.dol.com.tr.
milliyet.com.tr. 43200 IN NS doldns01.dol.com.tr.

;; ADDITIONAL SECTION:
doldns02.dol.com.tr. 43200 IN A 213.243.1.42
doldns01.dol.com.tr. 43200 IN A 213.243.1.40

;; Query time: 3 msec
;; SERVER: 144.122.95.52#53(144.122.95.52)
;; WHEN: Wed Dec 13 16:00:31 2006
;; MSG SIZE rcvd: 115

ustun@houston:~$

-------------------------------------------------------------------------------- ----------------

and below is the response from bind9 installed on a test machine to
the same query with the same configuration:

ustun@houston:~$ dig @144.122.95.178 milliyet.com.tr. -t ns

; <<>> DiG 9.3.2-P1 <<>> @144.122.95.178 milliyet.com.tr. -t ns
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34422
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;milliyet.com.tr. IN NS

;; AUTHORITY SECTION:
milliyet.com.tr. 43200 IN NS doldns02.dol.com.tr.
milliyet.com.tr. 43200 IN NS doldns01.dol.com.tr.

;; ADDITIONAL SECTION:
doldns01.dol.com.tr. 43200 IN A 213.243.1.40
doldns02.dol.com.tr. 43200 IN A 213.243.1.42

;; Query time: 89 msec
;; SERVER: 144.122.95.178#53(144.122.95.178)
;; WHEN: Wed Dec 13 15:59:14 2006
;; MSG SIZE rcvd: 115

ustun@houston:~$

-------------------------------------------------------------------------------- ------
recursion is not allowed in both machines. Bind8 looks at the zone
files at localhost, finds the NS record, queries root servers for
additional ip information and gives an answer. However, bind9 takes
this query as recursive, and does not return an answer although the NS
record is available at localhost in "com.tr." zone file. Bind9 logs
this:

Dec 13 16:34:11 localhost named[19911]: Dec 13 16:34:11.617 security:
debug 1: client 144.122.95.150#33024: recursion available: denied

I searched the list but couldn't find a satisfying answer. So why is
there a difference? How can we reconfigure bind9 to answer the query
as bind8 to preserve the same system?

Thanks and Regards,
ustun