>> All you need to do is not allow recursion for IPs outside your network.
>> For example my /var/named/chroot/etc/named.conf begins with:
> If that's the case then you can set that in the GUI! Just in case you
> didn't know :-)
Yes, that's what I thought too, but we have this set and are still
vulnerable. In testing and reading further, cache snooping and recursion
are related, yet different, things.
If you limit recursion to IP within your network, then it's true that
other IPs cannot use your DNS to lookup records that you are not
authoritative for.
However, if someone on your internal network looks up a record, it's
then saved in the DNS cache and anyone, regardless of their IP, can now
lookup that record from your cache. This is where the "cache snooping"
comes in -- people from outside can query your DNS cache and snoop what
records you have cached.
If have tried this with our servers and it works. Currently the only
reasonable fix I have seen for this is to upgrade BIND unless someone
here has a better idea.
Brian