RE: DNS cache poisoning?

["James C Slora Jr" <Jim.Slora () phra com>]

This appears to be related to a well known issue.

Windows DNS is subject to cache poisoning if forwarding to BIND 4 and 8
servers, which do not properly scrub data. Forwarding to BIND 9 should work
OK because BIND 9 works properly. 

So "dump Windows DNS and use BIND" does not adequately cover the issue.

See:
http://isc.sans.org/diary.php?date=2005-04-07
http://support.microsoft.com/default.aspx?scid=kb;en-us;241352
http://support.microsoft.com/kb/316786

> From KB241352, for NT4 SP4 or later:

1. Start Registry Editor (Regedt32.exe). 
2. Locate the following key in the registry:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DNS\Parameters  
3. On the Edit menu, click Add Value, and then add the following registry
value:
Value Name: SecureResponses
Data Type: REG_DWORD
Value: 1 (To eliminate non-secure data)  
4. Quit Registry Editor