--On Monday, March 25, 2013 6:24 PM -0400 Tom Metro <[email protected]>
wrote:
Disabling zone transfers is an attempts to hide the particulars within a
zone, but it is imperfect at best, as this information often leaks out
through other means (mail headers, for example). One possibility is to
It's less about security by obscurity and more about avoiding a denial of
service.
Zone transfers happen over TCP. TCP sockets are stateful connections. Most
name servers are monolithic processes. Thus, it is trivially easy to
monopolize a name server process by sending an AXFR request and then not
dropping the connection. The easiest way to prevent that is to simply say
"no" to the querent and drop the connection on the server side.
--
Rich P.
_______________________________________________
Discuss mailing list
[email protected]
http://lists.blu.org/mailman/listinfo/discuss
