Industry best practices (was Re: large organization nameservers
sean at donelan.com
Sun Aug 12 01:04:32 UTC 2007
Followups probably should go to the dnsops mailing list.
I got tired of things and went back to the original question, and put
together my list of what the "minimum" packets needed for full DNS
performance on the modern Internet.
It is the minimum, based on the security principle deny everything, allow
only what is needed. But "needed" is performance based. So it means not
relying on fallbacks, timeouts or hoping no one complains. It does not
include packets needed for diagnostic or troubleshooting information.
It is based on the "modern" Internet so does not included very deprecated
packets like Source Quench or unimplemented functions like broadcast DNS
It does include current Internet practices for EDNS, Notify, global DNS
load balancers and error handling I've seen in recent, i.e. less than 10
years old, DNS, Router and OS software.
I didn't included TOS/DSCP and some military options, mainly because I'm
not sure what "modern" military networks are currently using. If you are
using TOS/DSCP or military options, there are some things you will need to
More information about the NANOG