Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

DNS Recursive Queries and Cache Snooping

Posted on 2008-10-16
3
Medium Priority
?
1,774 Views
Last Modified: 2012-08-14
We have 2 public facing DNS servers on our network - both are in the DMZ, natted behind the PIX.  The company that does our vulnerability assessment says that there are security issues because they allow Recursive Queries, and DNS cache snooping.  
From what I've read on these issues, the solution is to check the "Disable recursion" box in the advanced tab of the properties on the DNS servers.
When I do that, however, I am instantly unable to browse to most sites from inside the network.  
What do I need to do to resolve these issues without affecting my internal network?

Thanks
0
Comment
Question by:brandenb
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 71

Accepted Solution

by:
Chris Dent earned 1500 total points
ID: 22738528

In short... You need to stop using servers responsible for public name resolution as a private caching servers.

Basically, in an ideal world public zones sit on servers dedicated to that task, they do not get used by internal clients directly and don't have recursion enabled to prevent unnecessary load on the servers.

Chris
0
 

Author Closing Comment

by:brandenb
ID: 31506866
Tells why we are having the problem without specifically answering the question
0
 
LVL 71

Expert Comment

by:Chris Dent
ID: 25113877

That's why you have the ability to post comments in reply :-p

> What do I need to do to resolve these issues without affecting my internal network?

You need to maintain separate public and private DNS servers or you need to run BIND which will allow you to limit who is allowed to use recursive queries.

Chris
0

Featured Post

Introducing the WatchGuard 420 Access Point

WatchGuard's newest access point includes an 802.11ac Wave 2 chipset, providing the fastest speeds for VoIP, video and music streaming, and large data file transfers. Additionally, enjoy the benefits of strong security as the 3rd radio delivers dedicated WIPS protection!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Occasionally you run into the website or two that will not resolve properly using your own DNS servers.  Some people simply set up global forwarders for their DNS server.  I don’t recommend doing this because it can cause problems resolving addresse…
BIND is the most widely used Name Server. A Name Server is the one that translates a site name to it's IP address. There is a new bug in BIND (https://kb.isc.org/article/AA-01272), affecting all versions of BIND 9 from BIND 9.1.0 (inclusive) thro…
This is my first video review of Microsoft Bookings, I will be doing a part two with a bit more information, but wanted to get this out to you folks.
Add bar graphs to Access queries using Unicode block characters. Graphs appear on every record in the color you want. Give life to numbers. Hopes this gives you ideas on visualizing your data in new ways ~ Create a calculated field in a query: …

704 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question