Scanning many DNS servers on the network, you can find many misconfigured ones acting as so-called "openDNS", i.e. answering queries for any domain. To make matters worse, many of them also allow transfer of the domains they serve.

• The correct solution should be a situation where:

• Each server answers questions ONLY about the domains it serves.
• It answers every query ONLY for the network it serves.
• It allows transferring its domains ONLY to its own secondary servers.

• We will carry out the configuration in the following steps:

• Before the global options section we define who can ask us about any domain:

acl "our_network" { 127.0.0.1/8; 192.168.1.0/24; };
				options {
					allow-query {"our_network";};
					};
		


At this point, if we don't have an allow-query directive in the zone configuration, we have "hidden" it from the outside world.
• The next step will be to determine who can query about our domain - in this case we want everyone to be able to:

			zone "ulos.pl" {
				type master;
				file "/etc/bind/ulos.pl";
				notify yes;
				allow-update { none; };
				allow-transfer {secondary_dns;};
				allow-query {0.0.0.0/0;};
			};
		

We should also pay attention to the allow-transfer directive, which makes it possible to learn all the records in our domain.
If we don't have backup servers, we block the transfer: allow-transfer {none;};

To check the effectiveness of our configuration, we have various tools at our disposal, e.g. dig.

• First we check that querying our server about other addresses is blocked, doing this from a different network; if we don't have another shell account, we can use online tools:
dig @our_server_ip some_other_ip
The result should be:


  
			 ; <<>> DiG 9.3.2 <<>> @ulos.pl wp.pl A
		 ; (1 server found)
		 ;; global options:  printcmd
		 ;; Got answer:
		 ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 65151
		 ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
		 
		 ;; QUESTION SECTION:
		 ;wp.pl.				IN	A
		 
		 ;; Query time: 38 msec
		 ;; SERVER: 217.113.238.23#53(217.113.238.23)
		 ;; WHEN: Mon Jul  5 15:58:03 2010
		 ;; MSG SIZE  rcvd: 23
		

• Next, we check the ability to transfer the domain via an external server:
dig ulos.pl AXFR


				; <<>> DiG 9.3.2 <<>> ulos.pl AXFR
					 ;; global options:  printcmd
 					; Transfer failed.