2

In the bind9 config (Centos8) there is a note saying

If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.

I would like to know why and if this is still a concern if the DNS server is entirely within a private network (only used as the dns server for the local network). This is assuming a reasonably high level of trust within the private network.

In my specific case I am talking ~10 servers and 20 users/clients, however I'm not sure that that matters...

Improve this question
0

2 Answers 2

Reset to default
3

I think I have found a satisfactory answer (for me) from ISC directly (didn't seem to be able to find this easily on google though!)

https://kb.isc.org/docs/bind-best-practices-authoritative

Do not combine authoritative and recursive nameserver functions -- have each function performed by separate server sets. This advice primarily concerns separation of public-facing authoritative services from internal client-facing recursive services - administrators may, for convenience, choose to serve some internal-only zones authoritatively from their recursive servers, having determined that the benefit outweighs any risks associated with this policy.

If you share recursive and authoritative functions in the one server, then if there is a problem that impacts authoritative servers only - for example, that causes all of your authoritative servers to fail - it will break your recursive service too.

I'll leave this here in case it helps anyone else, or if there is anything else others want to add:)

Improve this answer
4
  • 1
    I think this is actually the correct answer and not the other one about DNS amplification attacks.
    – Steffen Ullrich
    Commented May 1, 2020 at 14:43
  • @SteffenUllrich ah, you're right
    – multithr3at3d
    Commented May 1, 2020 at 15:45
  • Even for completely internal nameservers it is better to separate the two functions. It makes troubleshooting far easier (spoken by someone having been in the exact same setup and having to deal with all sorts of complicated problems around delegations and DNSSEC). If you read French, this is a good resource on the subject: bortzmeyer.org/separer-resolveur-autorite.html
    – Patrick Mevzek
    Commented Jun 3, 2020 at 1:11
  • Change this to be the "correct" answer based on comments... Not that I've really added much here though!
    – maloo
    Commented Feb 5, 2022 at 17:19
0

Edit: My answer ignored some of the critical points in the question, refer to OP's answer for the correct answer.

The primary concern is likely DNS amplification attacks, where your DNS server is sent requests from a spoofed IP address, and sends back replies to that forged address. This could be done using numerous public DNS servers, creating a DDoS of the target.

Since you are on a private network and the server is not reachable externally, this should not be a concern.

Improve this answer
3
  • I did think as much, and actually found an answer on ISC's website (see below). Surprisingly I couldn't find this in google... maybe my google-fu is slipping! Thanks for your answer though!
    – maloo
    Commented May 1, 2020 at 14:31
  • The question is specifically about why being recursive when being authorative is a problem. I cannot see how enabling recursive resolving increases the risk of DNS amplification.
    – Steffen Ullrich
    Commented May 1, 2020 at 14:40
  • Thanks Steffen:) In @multithr3at3d's defense though my question really contained two parts: 1) Why is this warning given and 2) If it is still an issue for a private DNS server. To me it answers both of those questions. I will admit though the answer from ISC is probably the best for the question title though...
    – maloo
    Commented May 1, 2020 at 17:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .