To CAIS Engineers - WAKE UP AND TAKE CARE OF YOUR CUSTOMERS

Tue May 15 14:18:55 UTC 2001

On Mon, 14 May 2001 23:18:09 PDT, Adam McKenna <adam at flounder.net>  said:
> It does hurt.  It causes non-obvious problems.  Forcing hostnames and PTR's
> to match (commonly referred to as PARANOID checking) does not provide extra
> security, it just prevents people with badly configured DNS from accessing
> your servers.

I once did a similar check in a Sendmail configuration, and found it to be
incredibly useful in reducing the spam load without significantly impacting
actual traffic.

There's a second-order effect here - the sort of clueless ISP that is unable
to get a PTR entry correct is *ALSO* the sort of clueless ISP that is very
likely unable to detect/eliminate hacker/spammer/etc nests in their address
space.

You of course need to be sure that your *own* DNS is rock-solid and up to
date (although our departmental network liaisons that maintain their zones
have learned that Things Will Not Work if they don't do it right ;).  You
also need to apply the usual skepticism for results - there *could* be a
temporary outage, for instance.

It's *NOT* a security measure to deploy by itself.  It's however useful as
Yet Another Part of a Complete and Balanced Security Breakfast... ;)

-- 
				Valdis Kletnieks
				Operating Systems Analyst
				Virginia Tech

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 211 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20010515/16d9b893/attachment.sig>