0

Is there any BIND functionality to provide privacy (encryption) for zone transfers. TSIG and DNSSEC provide authentication. Maybe I am being paranoid!

Improve this question

1 Answer 1

Reset to default
5

I think you're paranoid and see no reason to encrypt zonefiles. But if you really want to: set up a VPN between your master and slave nameservers and use that for transfering zonefiles.

Improve this answer
2
  • Thanks i reckon you are right. The main concern is that the slave is located in china. BIND security has never been so important to me until now.
    – gwillie
    Jun 19, 2013 at 10:48
  • @user1036745 do be aware that any DNS queries hitting the slave that originate outside of PRC will be "inspected" by the Great Firewall of China. If the queries match certain substrings they will send back fake answers too...
    – Alnitak
    Jun 20, 2013 at 10:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .