Subject: change named.conf to turn off recursion by default?
To: None <>
From: Steven M. Bellovin <>
List: tech-net
Date: 03/05/2006 19:11:10
Given the increasing problem of DOS reflector attacks via the DNS -- see

should we ship a named.conf that disables recursion?  OpenBSD has
shipped that way since at least 2004.  

The problem is that doing it properly requires the site to fill in
trusted hosts or nets, which means that it won't run properly out of
the box for some configurations.

 --Steven M. Bellovin,