-1

I am setting up two DNS servers on AWS, one is called ns1 and the other ns2. They will provide DNS records for my domain (example.com).

I have setup bind to handle forward lookups but I read that reverse lookups can be a security issue. However, mail servers might reject me.

So if ns1 had a public IP of 8.8.4.4 couldn't I use 4.4.8.8.in-addr.arpa as the reverse DNS instead of 4.8.8.in-addr-arpa?

That would prevent anyone from pretending to be part of the 8.8.4.0/24 subnet.

zone    "example.com"   {
    type master;
    file    "/etc/bind/forward.example.com";
};

zone   "4.4.8.8.in-addr.arpa"        {
   type master;
   file    "/etc/bind/reverse.example.com";
};
Improve this question
3
  • 1
    Did someone delegate 4.4.8.8.in-addr.arpa to you? No: Then no. Yes: Then yes. Wherever you read that 'reverse lookups can be a security issue'... I suggest you stop reading there. Forward and reverse work practically the same way. If the zone isn't delegated to you, how do you expect someone to 'pretend' to be it?
    – user143703
    Aug 5, 2015 at 22:37
  • If what you are actually looking for (to handle mail) is to have FCrDNS and you are hosting on a VPS, then you need to set the reverse DNS to a name/domain that you own and have set up in your forward DNS via the admin console. I use Linode, so I could only detail the steps in Linode, but I am sure AWS must have the same features/offerings. Many VPS providers will allow you to specify the reverse DNS for the IP provided their system is able to validate the forward lookup of the name you specify in the admin console.
    – Aaron
    Aug 5, 2015 at 22:52
  • I'm using cloud servers on both AWS (primary) and Rackspace (secondary). I own the domain example.com and they gave me public and private IPv4 addresses. I updated my original post to show what my bind record looks like.
    – linguru771x
    Aug 5, 2015 at 22:56

1 Answer 1

Reset to default
1

You should ensure that key resources have correct reverse DNS entries. This is especially true of your sending mail servers.

You have been given public static IPs probably owned by AWS and Rackservers. You should request these owners to add your host names to their relevant reverse DNS zones. If you do not own these reverse zones (AKA have them delegated to you) you cannot do it yourself.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .