Re: allow-recursive question

On Wed, 30 Mar 2005 11:14:27 +0100, Jim Reid <jim@rfc1035.com> wrote:
> >>>>> "Mariano" == Mariano Cunietti <mcunietti@enter.it> writes:
>
> Mariano> Should I disable recursive queries for users outside my
> Mariano> networks?
>
> YES! Nobody should be offering recursive DNS service to IP addresses
> outside their network. Open DNS service like that is almost as bad as
> an open mail relay. Of course authoritative name servers have to
> accept (non-recursive) queries from everywhere. These servers however
> should not be offering recursive service.

It might be a problem if you have "roaming" customers. In some OS
(the older Windows versions at least), a manually configured DNS would
override any DNS configured via DHCP. So if you have a customer with
a manually configured ethernet interface and he goes out of the office
and tries to connect via dialup to another provider, his DNS settings
will prevent the dialup interface from acquiring new DNS servers.

This might not be the case with Windows 2000 and later, since an
interface with no link is disabled by default.

I wouldn't go as far as saying that they are as bad as an open mail
relay, but open dns servers do tend to have a higher load (obviously).

Regards