Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

cat /etc/named.conf

acl "trusted" {

options {
allow-recursion { trusted; };
allow-notify { trusted; };
allow-transfer { trusted; };
allow-query { trusted; };
directory "/var/named";
dump-file "/var/named/named_cache_dump.db";
statistics-file "/var/named/named_stats.log";
empty-zones-enable no;

I saw the following and was wondering what IPs do I need to whitelist? Am I adding the root-nameservers?

I want to know how to protect myself from DNS attacks like illegal transfers/recursion/poisoning.

share|improve this question
up vote 3 down vote accepted

You really need two ACLs to handle that properly. One for peer name servers, and one for clients.

acl "nameservers" {
    # A list of all the name servers that this server has transfers or receices zones from
    # should basically be all the masters/slave name servers, for all defines zones

acl "internalclients" {
    # all your internal networks/client machines that can use this name server for resolution.;;;;

options {
    allow-notify { nameservers; };
    allow-transfer { nameservers; };
    allow-recursion { internalclients; };
    allow-query { internalclients; };

zone "" {
    allow-query {any;};
    allow-transfer { nameservers; };

For the best level of poisoning protection you really shouldn't be serving zones from the same DNS servers that you are using for client resolution though. But if you trust your internal clients, then I believe a setup like this is adequate.

share|improve this answer
So ACL nameservers is the IPs of my nameservers? -- if dns is hosted on same server as clients, it possible they could hijack transfers? – Tiffany Walker Feb 7 '13 at 20:49
Yes, the nameservers acl is a list of all your name servers. I don't think they your clients could hijack a transfer, but I am not 100% certain. – Zoredache Feb 7 '13 at 21:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.