RE: [Shorewall-users] fw2net DROP messages

[Cowles, S. <st...@st...>]

bogdan wrote:
> Hi all,
> 
> I am not sure I understant the phrase "recursive resolution for
> external clients?" .
> We run DNS with the resolution for the domains that we have
> registered for ourself and for some clients, I thought this was
> required by the DNS system to work properly? but now I am not sure.
> Can I run DNS without giving the access to the world? Is the answer
> in the word "recursive"? can it be any other type?
> 
> Thanks
> Bogdan

I believe what Tom was referring to was the "recursion yes/no" parameter in
your named.conf file. From the man pages...

 recursion
   If yes, and a DNS query requests recursion, then the server will
   attempt to do all the work required to answer the query.  If recursion
   is not on, the server will return a referral to the client if it
   doesn't know the answer.  The default is yes.  See also fetch-glue
   above.

In other words; if someone on the internet was to specify your name servers
IP address in their resolver lib configuration, do you want your server to
return an answer (yes) or return a referral (the root name servers) for
queries outside the zones you have loaded.

Steve Cowles