Security Question

Len Conrad LConrad at Go2France.com
Wed Jul 21 20:55:40 UTC 2004


>I was reading some stuff by Microsoft on split dns.  They insist that a
>dns server on a private network  should never use a root hints file

WTF does MS know about DNS? never say never.

>What do you all think about this?

DNS servers with smart/interative resolvers on internal nets require access 
to all internet that firewall policies will probably prefer to/insist on 
discouraging.

A double-wall firewall with a DMZ on public IPs is a well-proven approach. 
Put a resolving DNS, or two, in the DMZ, accepting recursive queries 
forwarded from the internal NS.  Minimizes traffic and rules at the 
internal firewall separating the DMZ from the internal net, and hides the 
internal NSs from Internet.

>Is it safe to use root hints from a
>private network behind a firewall

it's not automatically suicidal.  host and network security can handle 
iterative/resolving NSs on the internal net.

>or should you always forward?

it depends.

Len

_____________________________________________________________________
http://IMGate.MEIway.com : free anti-spam gateway, runs on 1000's of sites



More information about the bind-users mailing list