[AFMUG] DNS separation

2016-09-06 Thread That One Guy /sarcasm
Im putting our recursive sservers up for our network to use, theyre access limited by ACL and external router firewall policies to our networks only There will be four total servers NS1 and NS2 are our current authoritative only servers, they are public facingfor our domains and our ARIN allocatio

Re: [AFMUG] DNS separation

2016-09-06 Thread Josh Baird
I wouldn't be overly concerned about your recursive boxes being authoritative for your internal (only) zones. You already have mechanisms in place to prevent external clients from using them for recursive services. On Tue, Sep 6, 2016 at 3:20 PM, That One Guy /sarcasm < thatoneguyst...@gmail.com>

Re: [AFMUG] DNS separation

2016-09-06 Thread George Skorup
I have three machines on the network. Master at the NOC and two slaves at towers. They handle our domains, PTRs, etc. As well as DNS for customers. Recursion is locked down to our address blocks only. I also have an anycast address shared between all three. The infrastructure devices use that f

Re: [AFMUG] DNS separation

2016-09-06 Thread Jesse DuPont
We do it exactly as George said. Jesse DuPont Network Architect email: jesse.dup...@celeritycorp.net Celerity Networks

Re: [AFMUG] DNS separation

2016-09-07 Thread That One Guy /sarcasm
I got this all done Is there a good penetration test I can run against these servers to check for vulnerabilities? I have run billions of DNS config tests that are finally all responding well (with the exeption of autogenerated PTR) On Tue, Sep 6, 2016 at 3:19 PM, Jesse DuPont wrote: > We do i