ServerBuddies Support Blog

BIND Security

BIND supports a number of different methods to protect the updating and transfer of zones, on both master and slave nameservers:

DNSSEC — Short for DNS SECurity, this feature allows for zones to be cryptographically signed with a zone key.
In this way, the information about a specific zone can be verified as coming from a nameserver that has signed it with a particular private key, as long as the recipient has that nameserver’s public key.

BINDversion 9 also supports the SIG(0) public/private key method of message authentication.

TSIG — Short for Transaction SIGnatures, a shared secret key exists on the master and slave server, verifying that a transfer from master to slave is authorized.
This feature strengthens the standard IP address-based method of transfer authorization. An attacker would not only need to have access to the IP address to transfer the zone, but they would also need to know the secret key.

BINDversion 9 also support TKEY, which is another shared secret key method of authorizing zone transfers.

Troubleshooting BIND

There are a number of tools that are available to assist with testing and troubleshooting problems with your BIND configuration. The simplest tool on most systems is the host command, which simply performs an address lookup or a reverse address lookup. More complete information can be gathered using dig.

The simplest usage of host is to lookup an address, or a name.

Ask for the name servers that are authoritative for a domain by using the -t ns command line option..

The MX record can be retrieved by using the -t mx option.

Just like host, it is possible to query your default system resolver, or you can query a name server specified on the command line. For example, I could query my local name server about the nostarch.com domain.

More at http://doxfer.com/