DNS Blackholing

[rvandolson at esri.com]

All;

Am looking to do some DNS blackholing based on a pre-defined, dynamic list (such as DNS-BH).  Am looking for feedback on approaches for this.

Sounds like automatically generating an includeable config file with zone entries which point to a fairly bare zone definition file returning a honeypot IP or some such thing is fairly commonly done.

We have several resolvers (caching) servers, and am curious how others out there handle those.  Do you set up each as a master or do the master/slave thing?  Presumably the former do avoid needless duplication of the bare zone file.

In addition, how much memory is used by BIND for each zone definition?  We currently have a fairly small deployment with maybe a hundred zones tops.  If we suddenly jump to 10000+ -- even if they are all very small, how much memory can we expect to be chewed up so we can plan ahead?

Thanks for any thoughts.

Ray