[nsd-users] Unsecured zone transfers and open resolvers

[Arnt Gulbrandsen]

On 07/18/2012 10:16 PM, Valentin Bud wrote:
> This led me to the conclusion that the sys admins don't pay enough
> attention or don't really know or understand DNS technology.

Here's a list of what you get when you restrain zone transfers:

  - security through obscurity
  - somewhat lighter load (on ram, cpu or network)
  - a headache when some fool moves a server late on Friday

Add it up for yourself. Is the risk of running out of RAM bigger than 
the risk of someone reorganizing services and getting the ACLs wrong? Is 
security through obscurity something mildly desirable or something you 
want to avoid?

Arnt