mailing list archives
DNS forward only: why does it help?
From: Paul Szabo <psz () maths usyd edu au>
Date: Thu, 24 Jul 2008 07:28:15 +1000
As a workaround, it is recommended to set DNS servers to forward only.
Can someone explain why that helps? Cannot responses from the forwarder
be spoofed same as normal query responses? Is it that "glue RRs" from
forwarders are discarded; or that source ports of forwarded requests are
better randomized than normal queries; or that forwarding is done with
TCP not UDP?
The "published attack" has ns.victim.com spoofed. That does not affect a
server set to forward only. Could the attacker spoof login.victim.com
directly, and would not that affect a forward only server equally?
Paul Szabo psz () maths usyd edu au http://www.maths.usyd.edu.au/u/psz/
School of Mathematics and Statistics University of Sydney Australia
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- DNS forward only: why does it help? Paul Szabo (Jul 23)