Re: use of allow-query-cache

2 msg	logging rndc commands
1 msg	Thinking about keeping latest bind releases, cv...
2 msg	BIND + LDAP ERROR
4 msg	Question About SLAVE DNS and named.conf
2 msg	How to use rndc to get the list of zones
2 msg	Resolving confusion
2 msg	Re: Would like to change the default location o...
6 msg	multi CPU system 100% CPU useage
14 msg	split DNS?
5 msg	Strange domain issues - waterco.com.my
3 msg	Question About Boot.Zones
1 msg	fyi-- Re: dnscap V1.0-RC1
2 msg	newbie question
2 msg	Controlling the BIND cache (caching only author...
3 msg	Poisoned DNS?
2 msg	dig Query time
1 msg	Hooray, glue updates are instantaneous!
1 msg	dig blocks SIGINT,SIGTERM on Linux w/o threads

use of allow-query-cache
\ Allen Wooden (22 May 2007)
. \ Mark Andrews (22 May 2007)

2 msg	64-bit vs. 32 bit question

Subject:	Re: use of allow-query-cache
Group:	Bind-users
From:	Mark Andrews
Date:	22 May 2007

> I just upgraded my nameservers to 9.4.1 and wondered if
> there is any reason I should change my current
> configuration. Is there some future change coming down
> the road that would prompt me to change it?
>
> Or is this just convenient to put it in the options statement
> rather than put the allow-query in every authoritative zone?

The main reason is convience.

Note: the default acls for allow-recursion/allow-query-cache
are no-longer "any;". This won't impact you as you explicitly
set the acl. It may impact others.

2006. [security] Allow-query-cache and allow-recursion now default
to the builtin acls "localnets" and "localhost".

This is being done to make caching servers less
attractive as reflective amplifying targets for
spoofed traffic. This still leave authoritative
servers exposed.

The best fix is for full BCP 38 deployment to
remove spoofed traffic.

> options {
> allow-query { acl; };
> allow-recursion { acl; };
> };
>
> zone "blah.com" {
> allow-query { any; };
> };
>
> to
>
>
> options {
> allow-query-cache { acl; };
> allow-recursion { acl; };
> allow-query { any; };
> };
>
>
> zone "blah.com" {
>
> };
>
>
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742 INTERNET: Mark_Andrews