[isp-dns] Re: bind 9|8

[Len Conrad <LConrad@...]

> > Totally irrelevant for 99+% of DNS servers.
>
>   But now I can't host all my domains on my old 16 MHz 80386!  ;-)
afaik, FreeBSD doesn't support 286/386 anymore.  What else is there?  :))

The best security setup is "appliance" DNS's:

1. authoritative-only DNS:

options {
recursion no;
};

... immune to the SIG/OPT vulnerability ( assuming you don't have SIG + OPT 
records in your zones)

2. caching-only DNS:

options {
allow-query { my_networks; };
fetch-glue no;
};

... vulnerable only when my_networks recursively queries for SIG + 
OPT  records and gets answers.

Len