Hi <br>
Thanks for your valuable suggestions <br><br>>Run an up-to-date version of bind. Be fanatical about applying security<br>
>patches promptly.<br>
<br>Yes , i am running the latest version Bind-9.7.1-P2. <br><br>
>Don't allow recursion /at all/ for queries from the general public to<br>
>your authoritative servers, nor permit authoritative servers to send<br>
>additional data from cache.<br> <br>I am running separate caching and authoritative servers. As suggested<br>by you, i had disabled recursion to for the authoritative servers. <br><br>
<br>
>Permit only your trusted clients to make recursive queries through your<br>
>recursive servers.<br><br>Yes, in caching servers, i have only enabled recursion for our trusted clients. <br><br>
<br>
>If you have sufficient DNS traffic to warrant it, it is very good to run<br>
>completely separate instances of bind as authoritative and recursive<br>>servers -- use of virtualization techniques like FreeBSD jails can help<br>
>reduce hardware costs.<br><br>Yes, i am running separate instances of authoritative and recursive servers. <br>
<br>
>Allow bind to use as wide a range of port numbers as possible for UDP<br>
>traffic.<br>
<br>Yes this is allowed in the firewall. <br><br>
> Make sure your firewalls don't do daft things like forcing any DNS<br>
>traffic to come from a limited range of source ports, or blocking large<br>
>UDP packets or EDNS. Allow DNS queries over TCP as well as UDP.<br>
<br> Yes in firewall , both TCP and UDP DNS queries are allowed. <br><br>
> Implement DNSSEC.<br>
<br> I tried implementing dnssec using the following document <br><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta name="ProgId" content="Word.Document"><meta name="Generator" content="Microsoft Word 12"><meta name="Originator" content="Microsoft Word 12"><link rel="File-List" href="file:///C:%5CDOCUME%7E1%5Cnasub%5CLOCALS%7E1%5CTemp%5Cmsohtmlclip1%5C01%5Cclip_filelist.xml"><link rel="themeData" href="file:///C:%5CDOCUME%7E1%5Cnasub%5CLOCALS%7E1%5CTemp%5Cmsohtmlclip1%5C01%5Cclip_themedata.thmx"><link rel="colorSchemeMapping" href="file:///C:%5CDOCUME%7E1%5Cnasub%5CLOCALS%7E1%5CTemp%5Cmsohtmlclip1%5C01%5Cclip_colorschememapping.xml"><style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;
mso-font-charset:0;
mso-generic-font-family:roman;
mso-font-pitch:variable;
mso-font-signature:-1610611985 1107304683 0 0 159 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;
mso-font-charset:0;
mso-generic-font-family:swiss;
mso-font-pitch:variable;
mso-font-signature:-1610611985 1073750139 0 0 159 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{mso-style-unhide:no;
mso-style-qformat:yes;
mso-style-parent:"";
margin:0in;
margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-font-family:Calibri;
mso-fareast-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{mso-style-noshow:yes;
mso-style-priority:99;
color:blue;
text-decoration:underline;
text-underline:single;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-noshow:yes;
mso-style-priority:99;
color:purple;
mso-themecolor:followedhyperlink;
text-decoration:underline;
text-underline:single;}
.MsoChpDefault
{mso-style-type:export-only;
mso-default-props:yes;
font-size:10.0pt;
mso-ansi-font-size:10.0pt;
mso-bidi-font-size:10.0pt;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;
mso-header-margin:.5in;
mso-footer-margin:.5in;
mso-paper-source:0;}
div.Section1
{page:Section1;}
-->
</style><span style="font-size: 11pt; font-family: "Calibri","sans-serif";"><a href="http://blog.dustintrammell.com/2008/08/01/configuring-dnssec-in-bind/">http://blog.dustintrammell.com/2008/08/01/configuring-dnssec-in-bind/</a></span><br>
<br>After modifying named.conf for recursive server, i restarted named. <br><br>Now named is working with dnssec enabled .But i am not able to verify the same. <br><br>Kindly let me know how can we verify that dnssec is enabled and running , from the logs.<br>
<br>Thanks in advance. <br><br>Shiva Raman<br><br><br><br>