Re: is allow-update { none; } required for private DNS?

Barry Margolin wrote:
> In article <cjkn5g$2op6$1@sf1.isc.org>,
> crichmon@filc8046.fm.intel.com (Chris Richmond - MD6-FDC ~) wrote:
>
>
>>Hi Folks,
>>
>> I've got a bind 8.not-too-old server running on my linux router,
>>and from the HOWTO, it recommended that allow-udpate be disabled.
>>I don't have the exact syntax, but anyway...
>>
>>My understanding was that this kept my private DNS from corrupting
>>the real (outside) DNS if I screwed up my config. I'm reasonably
>>sure I haven't (its been a year or two). I've added dhcpd not
>>so long ago (serve addresses to some internal computers), and I'd
>>like to have dynamic hosts registered, but I get bind messages in
>>/var/log/messages that I can't. Sorry, I don't have the exact
>>message.
>>
>>Is my understanding of the directive correct?
>>Can I safely undo it and is it even related to the dhcp
>>issue?
>
>
> This directive controls the server accepting updates being sent to it.
> BIND never sends updates, so it has nothing to do with corrupting
> outside DNS. If you want to create DNS entries on a server on your
> private network for the DHCP-assigned addresses, then you need to allow
> updates.
>
My setup with BIND and DHCP on the same box has
allow-update { 127.0.0.1; 192.168.99.1; };
with 192.168.99.1 being the DNS/DHCP server.

This works. It allows updates from the DHCP process, but not from any
nasty Windows machines...

It does not affect the DNS server's interaction with any other DNS servers.

Steve