In a typical hidden-master DNS network layout, there are basically two components:
- Hidden master DNS server, may be behind a NAT or firewall, or be totally exposed
- Slave authoritative non-recursive DNS server(s)
Zone files on slave DNS servers often do not (and should not) have information to this hidden master DNS server. But these same slave DNS servers do require the use of certain DNS options like
allow-transfer, and some ACLs.
While at first, those required
allow-update seem to require an IP address match list. This leaves the
named.conf as the primary source of such stealth information (i.e. the IP address of the hidden-master).
Can such exposure of the IP address to the hidden-master DNS server be further limited by using keys instead and not using any IP address in the
The key answer I’m looking for is whether or not we can minimize exposure of hidden-master at the level of its configuration file as well as in zone databases.