<html><body bgcolor="#FFFFFF"><div>Nah, that's fine (and normal).</div><div><br></div><div>BIND comes configured with the roots so that it can start resolution. I guess I don't fully understand your concern here -- is it that you are worried that the root might see queries and so know your internal hostnames?</div><div><br></div><div>W</div><div><br><div>Warren Kumari</div><div>------</div>Please excuse typing, etc -- This was sent from a device with a tiny keyboard.</div><div><br>On Mar 17, 2011, at 7:20 AM, babu dheen <<a href="mailto:babudheen@yahoo.co.in">babudheen@yahoo.co.in</a>> wrote:<br><br></div><div></div><blockquote type="cite"><div><table cellspacing="0" cellpadding="0" border="0"><tbody><tr><td valign="top" style="font: inherit;"><div>Hi,</div>
<div> </div>
<div> We have two internal Windows DNS servers which answer all DNS query by forwarding it to gateway DNS server running in Redhat BIND. But i have a query regarding allowing ROOT DNS query on internal DNS server.</div>
<div> </div>
<div>Can anyone let me know whether company Internal DNS server should respond to ROOT DNS query. When i execute # dig . NS @my-company-name-server query I am getting complete response</div>
<div> </div>
<div> Let me know whether enabling ROOT DNS query is a security threat. For more informaton can you read and help us to securely configure our company internal Windows DNS server and its impact of disabling it.</div>
<div> </div>
<div> </div>
<div>; <<>> DiG 9.3.3rc2 <<>> . NS @10.0.0.1<br>; (1 server found)<br>;; global options: printcmd<br>;; Got answer:<br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34899<br>;; flags: qr rd ra; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 10</div>
<div>;; QUESTION SECTION:<br>;. IN NS</div>
<div>;; ANSWER SECTION:<br>. 49842 IN NS <a href="http://j.root-servers.net">j.root-servers.net</a>.<br>. 49842 IN NS <a href="http://k.root-servers.net">k.root-servers.net</a>.<br>. 49842 IN NS <a href="http://l.root-servers.net">l.root-servers.net</a>.<br>. 49842 IN NS
<a href="http://m.root-servers.net">m.root-servers.net</a>.<br>. 49842 IN NS <a href="http://a.root-servers.net">a.root-servers.net</a>.<br>. 49842 IN NS <a href="http://b.root-servers.net">b.root-servers.net</a>.<br>. 49842 IN NS <a href="http://c.root-servers.net">c.root-servers.net</a>.<br>. 49842 IN NS
<a href="http://d.root-servers.net">d.root-servers.net</a>.<br>. 49842 IN NS <a href="http://e.root-servers.net">e.root-servers.net</a>.<br>. 49842 IN NS <a href="http://f.root-servers.net">f.root-servers.net</a>.<br>. 49842 IN NS <a href="http://g.root-servers.net">g.root-servers.net</a>.<br>. 49842 IN NS
<a href="http://h.root-servers.net">h.root-servers.net</a>.<br>. 49842 IN NS <a href="http://i.root-servers.net">i.root-servers.net</a>.</div>
<div>;; ADDITIONAL SECTION:<br><a href="http://j.root-servers.net">j.root-servers.net</a>. 49842 IN A 192.58.128.30<br><a href="http://a.root-servers.net">a.root-servers.net</a>. 49842 IN A 198.41.0.4<br><a href="http://b.root-servers.net">b.root-servers.net</a>. 49842 IN A 192.228.79.201<br><a href="http://c.root-servers.net">c.root-servers.net</a>. 49842 IN A 192.33.4.12<br><a href="http://d.root-servers.net">d.root-servers.net</a>. 49842 IN A 128.8.10.90<br><a href="http://e.root-servers.net">e.root-servers.net</a>. 49842 IN A
192.203.230.10<br><a href="http://f.root-servers.net">f.root-servers.net</a>. 49842 IN A 192.5.5.241<br><a href="http://g.root-servers.net">g.root-servers.net</a>. 49842 IN A 192.112.36.4<br><a href="http://h.root-servers.net">h.root-servers.net</a>. 49842 IN A 128.63.2.53<br><a href="http://i.root-servers.net">i.root-servers.net</a>. 49842 IN A 192.36.148.17</div>
<div>;; Query time: 34 msec<br>;; SERVER: 10.0.0.1#53(10.132.1.13)<br>;; WHEN: Thu Mar 17 17:16:18 2011<br>;; MSG SIZE rcvd: 401<br></div></td></tr></tbody></table><br></div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>bind-users mailing list</span><br><span><a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a></span><br><span><a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a></span></div></blockquote></body></html>