[87887] in North American Network Operators' Group
Re: AW: Odd policy question.
daemon@ATHENA.MIT.EDU (Michael Loftis)
Fri Jan 13 15:26:08 2006
Date: Fri, 13 Jan 2006 13:25:23 -0700
From: Michael Loftis <mloftis@wgops.com>
To: nanog@merit.edu
In-Reply-To: <17352.2319.950212.765685@roam.psg.com>
X-MailScanner-From: mloftis@wgops.com
Errors-To: owner-nanog@merit.edu
--On January 13, 2006 10:09:51 AM -1000 Randy Bush <randy@psg.com> wrote:
>
>> it is a best practice to separate authoritative and recursive servers.
>
> why?
Cache poisoning (though this is less likely with more modern bind's and
other resolvers) and the age old your view is NOT the same as the world
view. IE if you've got a customer who has offsite DNS, but hasn't told
you, and you've got authoritative records for his zone, you might be
delivering mail locally, or to the wrong place, and it can take a long time
to figure this out.
>
> e.g. a small isp has a hundred auth zones (secondaried far
> away and off-net, of course) and runs cache. why should
> they separate auth from cache?
>
> randy
>
>
--
"Genius might be described as a supreme capacity for getting its possessors
into trouble of all kinds."
-- Samuel Butler
