I am setting up two DNS servers on AWS, one is called ns1 and the other ns2. They will provide DNS records for my domain (example.com).

I have setup bind to handle forward lookups but I read that reverse lookups can be a security issue. However, mail servers might reject me.

So if ns1 had a public IP of couldn't I use as the reverse DNS instead of 4.8.8.in-addr-arpa?

That would prevent anyone from pretending to be part of the subnet.

zone    "example.com"   {
    type master;
    file    "/etc/bind/forward.example.com";

zone   ""        {
   type master;
   file    "/etc/bind/reverse.example.com";
  • 1
    Did someone delegate to you? No: Then no. Yes: Then yes. Wherever you read that 'reverse lookups can be a security issue'... I suggest you stop reading there. Forward and reverse work practically the same way. If the zone isn't delegated to you, how do you expect someone to 'pretend' to be it? – yoonix Aug 5 '15 at 22:37
  • If what you are actually looking for (to handle mail) is to have FCrDNS and you are hosting on a VPS, then you need to set the reverse DNS to a name/domain that you own and have set up in your forward DNS via the admin console. I use Linode, so I could only detail the steps in Linode, but I am sure AWS must have the same features/offerings. Many VPS providers will allow you to specify the reverse DNS for the IP provided their system is able to validate the forward lookup of the name you specify in the admin console. – Aaron Aug 5 '15 at 22:52
  • I'm using cloud servers on both AWS (primary) and Rackspace (secondary). I own the domain example.com and they gave me public and private IPv4 addresses. I updated my original post to show what my bind record looks like. – linguru771x Aug 5 '15 at 22:56

You should ensure that key resources have correct reverse DNS entries. This is especially true of your sending mail servers.

You have been given public static IPs probably owned by AWS and Rackservers. You should request these owners to add your host names to their relevant reverse DNS zones. If you do not own these reverse zones (AKA have them delegated to you) you cannot do it yourself.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.