<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<br>
<br>
<div class="moz-cite-prefix">On 2/15/22 09:06, Andrew Baker via
bind-users wrote:<br>
<br>
<br>
</div>
<blockquote type="cite"
cite="mid:AS8P190MB1048100AF90D87E704831A5E8D349@AS8P190MB1048.EURP190.PROD.OUTLOOK.COM">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style>@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:8.0pt;
margin-left:.5in;
mso-add-space:auto;
line-height:105%;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
mso-add-space:auto;
line-height:105%;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
mso-add-space:auto;
line-height:105%;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0in;
margin-right:0in;
margin-bottom:8.0pt;
margin-left:.5in;
mso-add-space:auto;
line-height:105%;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}div.WordSection1
{page:WordSection1;}ol
{margin-bottom:0in;}ul
{margin-bottom:0in;}</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">Dear List,<o:p></o:p></p>
<p class="MsoNormal">We are based in the middle east and manage
a lot of domains across a lot of tld’s including regional
ones. Not all registrars are equal and the DNS services of
several weren’t offering what we required. For a number of
operational and political reasons, it was decided to setup a
distributed public DNS for our domains that we managed. It was
an interesting project as it’s the first time we’ve used bind
in anger.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We now have a master and two slave DNS
servers in two of our DC’s in the region and have additional
slaves outside the region to provide DR resilience for around
40% of our domains that are actually active. Everything is
running smoothly now, and I’d like to take one final step to
make the master DNS hidden and leave the slaves to handle all
the requests.<o:p></o:p></p>
<p class="MsoNormal">I can see two possible ways of doing this….<o:p></o:p></p>
<ol style="margin-top:0in" type="1" start="1">
<li class="MsoListParagraphCxSpFirst"
style="margin-left:0in;mso-add-space:auto;mso-list:l0 level1
lfo1">
Configure the “allow queries from” to just the slave servers<o:p></o:p></li>
<li class="MsoListParagraphCxSpLast"
style="margin-left:0in;mso-add-space:auto;mso-list:l0 level1
lfo1">
Setup rules on our external firewall to block requests from
anything other than the slave servers</li>
</ol>
</div>
</blockquote>
<br>
I'd take the masters off the registrar NS list, and just leave the
slaves.<br>
<br>
DNS queries won't be sent to name servers that aren't listed as
authoritative for the zone.<br>
<br>
In the background, the master will still control the zones and
notify the slaves of any record changes.<br>
<br>
I suppose you can add a firewall rule on the masters to block
unwanted requests, but I try to make things as complicated as
possible, and no more so.<br>
<br>
Mark.<br>
</body>
</html>