DNS Best Practice Resources

DNS resources developed by Cricket Liu, Infoblox VP of architecture and author of O’Reilly’s DNS and BIND

2008 DNS Survey Results

Many Systems Still Vulnerable to Attacks Despite Some Marked Improvements

Reference

DNS Resources Directory - András Salamon’s directory is a great source of links to information about DNS and its implementations.
www.bind9.net - Another good directory of links to information about DNS and BIND, specifically.
www.dnssec.net - Afrom. the guy who gave us www.bind9.net, here's another invaluable resource: a directory of information about DNSSEC, the DNS Security Extensions.

Organizations

The Internet Systems Consortium's BIND page – Straight from the horse’s mouth: Pointers to source code and information on BIND from its developers.
The IETF DNS Extensions Working Group's web page, http://www.ietf.org/html.charters/dnsext-charter.html
The IETF DNS Operations Working Group's web page, http://www.ietf.org/html.charters/dnsop-charter.html
The North American Network Operators Group, or NANOG, often hosts talks about DNS. You can find a great collection of these talks here:
http://www.nanog.org/subjects.html#D, including information on the attacks against the root name servers.

BIND FAQ

Secure BIND Template - Rob Thomas’s excellent template named.conf file shows administrators best practices in securing their BIND name servers.
Log messages for BIND 8 named, named-xfer and ndc and some for BIND 9 - Kevin O’Neil collected this long list of error messages and added explanations for many of them, gleaned from mailing lists and USENET newsgroups.

Security

ISC's BIND Security Matrix, showing which vulnerabilities exist in each
version of BIND, http://www.isc.org/sw/bind/bind-security.php.

"DNS Damage - Measurements at a Root Server" – This is a fascinating—if also very disturbing—look at the mix of queries received by f.root-servers.net, one of the Internet’s root name servers. If you haven’t read it already, you won’t believe the percentage of the query traffic that this root receives that’s essentially garbage.

Mailing lists

An archive of the BIND Users mailing list – The BIND Users mailing list hosts discussion of configuration and management of the BIND name server.
An archive of the BIND 9 Users mailing list – The BIND 9 Users mailing list used to host discussion of the BIND 9 name server, but has since been folded into the BIND Users mailing list. However, you may still want to search the archive of the pre-merger list.

Tools

DNS, BIND, DHCP, LDAP and Directory Services - www.bind9.net’s directory of DNS tools.
Tools to manage DNS– DNSRD’s version of the same.
DNS LOC: Geo-enabling the Domain Name System - Christopher Davis's web page on publishing location information in DNS using the LOC record.
www.dnsstuff.com - A great selection of DNS-related tools and forums.
www.openspf.org - An excellent place to learn about the Sender Policy Framework (SPF), which helps combat email spoofing. Includes an indispensable, web-based wizard for creating SPF records.

Written by Cricket Liu


DNS and BIND, Fifth Edition	DNS & Bind Cookbook	DNS on Windows Server 2003, Third Edition

Articles

O'Reilly Network - Cooking with DNS & BIND - Chapter 5 – Chapter 5 of the Cookbook, with recipes on operation of BIND name servers.
O'Reilly Network - Cooking with DNS & BIND - Chapter 7 – Chapter 7 of the Cookbook, with recipes on securing BIND name servers.
The Ties that BIND – An article I wrote for Linux Magazine explaining how to configure BIND name servers to support Microsoft’s Active Directory. (Please note: I didn’t choose the title.)
Securing DNS – An article I wrote for Linux Magazine explaining how to use TSIG to secure zone transfers and dynamic updates.
O'Reilly Sys Admin Networking - "Upgrading to BIND 9: The Top Nine Gotchas" Another article I wrote for O’Reilly, this one describing what to watch out for when upgrading to BIND 9 from previous versions.
O'Reilly Sys Admin Networking - " Views in BIND 9" – An article I wrote for O’Reilly describing how to configure views in BIND 9.
DNS and BIND, 4th Edition: Chapter 11: Security - A whole chapter from DNS and BIND, given away for free (argh!), on securing name servers.
CERT® Coordination Center - "Securing an Internet Name Server" – A document on securing Internet name servers, published by CERT, based on a presentation I wrote.