Re: Security Question

>I was reading some stuff by Microsoft on split dns. They insist that a
>dns server on a private network should never use a root hints file

WTF does MS know about DNS? never say never.

>What do you all think about this?

DNS servers with smart/interative resolvers on internal nets require access
to all internet that firewall policies will probably prefer to/insist on
discouraging.

A double-wall firewall with a DMZ on public IPs is a well-proven approach.
Put a resolving DNS, or two, in the DMZ, accepting recursive queries
forwarded from the internal NS. Minimizes traffic and rules at the
internal firewall separating the DMZ from the internal net, and hides the
internal NSs from Internet.

>Is it safe to use root hints from a
>private network behind a firewall

it's not automatically suicidal. host and network security can handle
iterative/resolving NSs on the internal net.

>or should you always forward?

it depends.

Len

__________________________________________________ ___________________
http://IMGate.MEIway.com : free anti-spam gateway, runs on 1000's of sites