separation of authoritative and recursive functions on internal networks

Mark Andrews marka at isc.org
Mon Aug 10 18:12:01 UTC 2015


Authoritative servers (listed in NS records) shouldn't be recursive.
This prevents leakage of cache data.  This provide consistent
answers.  The server also doesn't have to decide what type of answer
to give (recursive vs authoritative).  Glue doesn't get overridden
by answers, etc.

Recurive servers (honouring RD=1) however can be authoritative for
zones.  This proves robustness in the presence of link failures.
Faster than ttl expiry of local zone changes (provided that notify
messages are sent).

Unfortunately this has become strict seperation lore which really
wasn't ever the intent.

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka at isc.org


More information about the bind-users mailing list