Eric Shubert wrote:
I don't know off hand.
Hey Jake, what do you know about this? (I'm guessing quite a bit!)
Maxwell Smart wrote:
Eric,
I think I am getting it sorted. Here is a snip of my named.conf
file. Do I need to allow-query;? Also do I need the forwarders,
ISP's DNS servers since the db.cache is the ROOT SERVERS? From what
I have read it is the recommended way to set it up.
options {
directory "/etc";
pid-file "/var/run/named/named.pid";
version "request not permitted";
allow-notify {64.168.70.132;};
allow-transfer {"none";};
forwarders {
63.203.35.55;
206.13.28.12;
206.13.30.12;
};
};
zone "." {
type hint;
file "/etc/db.cache";
};
There are 2 mind sets to forwarders. If you do not define your ISPs,
your server will use the root servers. You are obviously getting the
highest authority on answers there, but resolve times can lag a little.
By using your ISPs upstream servers for forwarders, you're cutting down
on network traffic since your request is only going to the ISP
office/colo instead of one of the root DNS servers (which may be in
another state). So you have to look at it both as a security view, and a
bandwidth view. I think by now all of the ISP DNS servers are patched
for the cache poisoning so that is probably not a concern, but if your
ISP does DNS redirecting for unknown/unresolvable domains then you may
need to take that into consideration.
For allow query, you're now going to be moving into the realm of an
authoritative and resolving server in the same box. Perfectly fine, if
you configure correctly. Normally with allow-query you would define an
acl (access list) that is allowed to query your server. You can even do
some fancy stuff like I do here in my office and have different DNS
zones for your internal network and your external network.
---------------------------------------------------------------------------------
Qmailtoaster is sponsored by Vickers Consulting Group
(www.vickersconsulting.com)
Vickers Consulting Group offers Qmailtoaster support and installations.
If you need professional help with your setup, contact them today!
---------------------------------------------------------------------------------
Please visit qmailtoaster.com for the latest news, updates, and packages.
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
