Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: AW: Odd policy question.

  • From: Steven M. Bellovin
  • Date: Fri Jan 13 15:38:41 2006

In message <838DBE2645430DF70BAFFC9C@dhcp-2-206.wgops.com>, Michael Loftis writ
es:
>
>
>
>--On January 13, 2006 10:09:51 AM -1000 Randy Bush <randy@psg.com> wrote:
>
>>
>>> it is a best practice to separate authoritative and recursive servers.
>>
>> why?
>
>Cache poisoning (though this is less likely with more modern bind's and 
>other resolvers) and the age old your view is NOT the same as the world 
>view.  IE if you've got a customer who has offsite DNS, but hasn't told 
>you, and you've got authoritative records for his zone, you might be 
>delivering mail locally, or to the wrong place, and it can take a long time 
>to figure this out.

Yes.  However, that has to be weighed against the greater immunity to 
cache poisoning in authoritative servers -- if a server *knows* it has 
the real data, it has much stronger grounds for rejecting nonsense.  
This is, in fact, one of the tests used.

		--Steven M. Bellovin, http://www.cs.columbia.edu/~smb






Discussion Communities


About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home


Merit Network, Inc.