1

In the bind9 config (Centos8) there is a note saying

If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.

I would like to know why and if this is still a concern if the DNS server is entirely within a private network (only used as the dns server for the local network). This is assuming a reasonably high level of trust within the private network.

In my specific case I am talking ~10 servers and 20 users/clients, however I'm not sure that that matters...

0
0

Edit: My answer ignored some of the critical points in the question, refer to OP's answer for the correct answer.

The primary concern is likely DNS amplification attacks, where your DNS server is sent requests from a spoofed IP address, and sends back replies to that forged address. This could be done using numerous public DNS servers, creating a DDoS of the target.

Since you are on a private network and the server is not reachable externally, this should not be a concern.

3
  • I did think as much, and actually found an answer on ISC's website (see below). Surprisingly I couldn't find this in google... maybe my google-fu is slipping! Thanks for your answer though! – maloo May 1 '20 at 14:31
  • The question is specifically about why being recursive when being authorative is a problem. I cannot see how enabling recursive resolving increases the risk of DNS amplification. – Steffen Ullrich May 1 '20 at 14:40
  • Thanks Steffen:) In @multithr3at3d's defense though my question really contained two parts: 1) Why is this warning given and 2) If it is still an issue for a private DNS server. To me it answers both of those questions. I will admit though the answer from ISC is probably the best for the question title though... – maloo May 1 '20 at 17:12
2

I think I have found a satisfactory answer (for me) from ISC directly (didn't seem to be able to find this easily on google though!)

https://kb.isc.org/docs/bind-best-practices-authoritative

Do not combine authoritative and recursive nameserver functions -- have each function performed by separate server sets. This advice primarily concerns separation of public-facing authoritative services from internal client-facing recursive services - administrators may, for convenience, choose to serve some internal-only zones authoritatively from their recursive servers, having determined that the benefit outweighs any risks associated with this policy.

If you share recursive and authoritative functions in the one server, then if there is a problem that impacts authoritative servers only - for example, that causes all of your authoritative servers to fail - it will break your recursive service too.

I'll leave this here in case it helps anyone else, or if there is anything else others want to add:)

3
  • 1
    I think this is actually the correct answer and not the other one about DNS amplification attacks. – Steffen Ullrich May 1 '20 at 14:43
  • @SteffenUllrich ah, you're right – multithr3at3d May 1 '20 at 15:45
  • Even for completely internal nameservers it is better to separate the two functions. It makes troubleshooting far easier (spoken by someone having been in the exact same setup and having to deal with all sorts of complicated problems around delegations and DNSSEC). If you read French, this is a good resource on the subject: bortzmeyer.org/separer-resolveur-autorite.html – Patrick Mevzek Jun 3 '20 at 1:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.