Re: how many angels can dance on the head of a pin?

[Paul Vixie <[e-mail]>]

> From: [e-mail]
> 
> At least for the ISP *I* work for, our publicly accessible caches are
> accessible for direct recursive queries only from IP addresses within
> our own AS, not from the Internet at large.

may i ask that you write an FYI RFC for dnsop explaining this policy with
special emphasis on (1) how you did it, (2) how easy it was to do it, and
(3) how beneficial it's been that you did it.  many of your coopetitors
across the industry are not yet following in these excellent footsteps.

(and it won't make you safe from spoofing if you have a dialup or enduser
population who can be infested with bots, or if you have SMTP servers who
can be triggered to make DNS requests for an attacker with very fine
timing, but this kind of network hygiene certainly limits the scope of
the problem.)

(if you also enforce BCP38 against your customers, you might mention this
in passing in your FYI RFC, again explaining how easy it was and how much
cost and/or benefit you get from it.)

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>