Re: DNS cache poisoning - am I safe if I limit recursion to trusted local networks?

2022-01-04 Thread Ray Bellis
On 04/01/2022 21:12, Grant Taylor via bind-users wrote: Yep. This is where I have settled. But I don't feel I can defend it when asked. Hence my seeking to better understand. There are categories of bugs that specifically affect recursion, and in BIND these are _much_ more common than

Re: DNS cache poisoning - am I safe if I limit recursion to trusted local networks?

2022-01-04 Thread Grant Taylor via bind-users
On 1/4/22 4:37 AM, Ray Bellis wrote: Better yet, use BIND's mirror zones feature so that the zone is also DNSSEC validated. Completely agreed. I think the type of authoritative information is somewhat independent of the fact that any authoritative information exists. IMHO, the strictures

Re: How to show run the active configuration on bind

2022-01-04 Thread Ray Bellis
On 04/01/2022 16:53, Mik J via bind-users wrote: Hello, How can I check which variables are loaded in memory and considered as active. For example, I would like to check that the value of lame-ttl is 0 In my named.conf configuration file I have include "myconf.conf"; lame-ttl 600; And in

How to show run the active configuration on bind

2022-01-04 Thread Mik J via bind-users
Hello, How can I check which variables are loaded in memory and considered as active. For example, I would like to check that the value of lame-ttl is 0In my named.conf configuration file I haveinclude "myconf.conf"; lame-ttl 600; And in the myconf.conf file I havelame-ttl 0; So how can I make

Re: DNS cache poisoning - am I safe if I limit recursion to trusted local networks?

2022-01-04 Thread Ray Bellis
On 04/01/2022 03:52, Grant Taylor via bind-users wrote: If I'm allowing recursion and authoritative on the same server, I'd have the recursive + authoritative server do secondary zone transfers off of the internal MS-DNS / AD server.  That way the clients can get the info off of the first