SERVFAIL for some domains on some servers

Florian Weimer fw at deneb.enyo.de
Sun Mar 7 21:35:26 UTC 2010


* Kevin Darcy:

> I'm not sure those recommendations apply as strongly as they used
> to. Now we have views and (if the original poster were to upgrade to
> 9.4.x or higher) fine-grained control over access to cached data.

Views are probably okay.  Access control is insufficient, especially
if you register domains on behalf of customers.  Typically, you need
to activate these domains prior to obtaining the delegation, and the
recursor will return incorrect data when you fail to actually get the
delegation.



More information about the bind-users mailing list