DNS Security Options

Note that anything that is occurring to the zones within the DNS server is controlled from the options directive in named.conf, anything applied to it applies to all zones. Unless you apply a directive within the zone, it will only apply to that zone.

A good practice is restricting zone transfer, and allow transfer to only those servers that it is designated to. In this case the slave must be able to transfer the data required (your domain name) for the slave to be able to answer to queries from other servers asking for your domain.

If you wanted to allow transfer to a name server sitting at: 192.168.1.50 you would do it as follow.

zone	“netcontrol.org” {
allow-transfer {192.168.1.50; localhost;};
	};

This ensures that only the information that is requested will be available. That will avoid transferring detailed information about your configurations.

Protecting against spoofing

Probably this might be obvious to you… First you will need to disable queries for domains you don't own, and allow queries for only those you want such as your internal network.

	options {
		allow-query {192.168.1.0/24; localhost;};
	};


	zone “netcontrol.org”{
		allow-query {any;};
	};

	zone	“26.34.168.in-addr.arpa”{
		allow-query {any;};

 	options {
		Allow-query {192.168.1.0/24; localhost;};
	};