Re: Set NSD to ignore, instead of refusing, external recursive queries?
Tom Hendrikx <[email protected]>
| Newsgroups | gmane.network.dns.nsd.general |
|---|---|
| Message-ID | <[email protected]> |
Hi, If you a run hidden service, ie. one that is not pointed to by other public service such as DNS records specifying you as NS, you might be right. But when your service is initially public, then why should you make it harder for people to use it? Abusers will come by anyway, they're not fooled by the fact that you're dropping packets sometimes... My 2 cents, Tom On 06-06-17 22:02, Sebastian Nielsen wrote: > My tought is that its harder to scan for DNS servers and (eventually) > attack them, if they don't reply at all unless its absolute necessary > (eg if it’s a authorative query for something the server is > authorative for). > > Have you heard about GRC, Gibson Research Corporation? They say, that > its better to ignore instead of replying. > > -----Ursprungligt meddelande----- Från: Paul Wouters > [mailto:[email protected]] Skickat: den 6 juni 2017 04:55 Till: > Sebastian Nielsen <[email protected]> Kopia: [email protected] > Ämne: Re: [nsd-users] Set NSD to ignore, instead of refusing, > external recursive queries? > > On Tue, 6 Jun 2017, Sebastian Nielsen wrote: > >>>> Is it possible to tell NSD to just drop recursive queries, >>>> instead of replying with a “REFUSED” message? >>> >>> Why do you want to receive double the queries? > >> What do you mean? > > If a real DNS client is sending you a query, and it does not get a > response, it will likely try 2 more times. By not answering, you will > get double or tripple the traffic. > >> Some security scans say the following: >> >> External Query: Rejected (Recommended: Drop) >> >> And list it as a yellow status. > > Some security software needs to hire some DNS people :) > > Paul > > > > _______________________________________________ nsd-users mailing > list [email protected] > https://open.nlnetlabs.nl/mailman/listinfo/nsd-users > _______________________________________________ nsd-users mailing list [email protected] https://open.nlnetlabs.nl/mailman/listinfo/nsd-users