[87918] in North American Network Operators' Group
Re: AW: Odd policy question.
daemon@ATHENA.MIT.EDU (Florian Weimer)
Sat Jan 14 04:53:57 2006
From: Florian Weimer <fw@deneb.enyo.de>
To: Randy Bush <randy@psg.com>
Cc: "John van Oppen" <john@vanoppen.com>, <nanog@merit.edu>
Date: Sat, 14 Jan 2006 10:45:12 +0100
In-Reply-To: <17352.2319.950212.765685@roam.psg.com> (Randy Bush's message of
"Fri, 13 Jan 2006 10:09:51 -1000")
Errors-To: owner-nanog@merit.edu
* Randy Bush:
>> it is a best practice to separate authoritative and recursive servers.
>
> why?
>
> e.g. a small isp has a hundred auth zones (secondaried far
> away and off-net, of course) and runs cache. why should
> they separate auth from cache?
Some registrars require that you begin to serve the domain before it's
actually delegated to you. If you don't run a split setup, it might
happen that you hijack someone else's domain. For example, some ISPs
already serve .EU domains on their resolvers, although they haven't
been delegated to them yet. A unified setup also means that customers
can hijack domains (intentionally or not) if your registratry checks
go wrong. And you don't notice if the delegation goes astray for some
reason.
The upside of a unified setup is that DNS continues to work even if
you're disconnected from the Internet. It is somewhat easier to
configure. And you aren't subject to DNS spoofing attacks for your
own domains.
