[dns-operations] Best Practices in DNS security

[gilles.massen at restena.lu]

Could you please give an example for this? 

Basically I'm trying very hard to find how bad running authoritative and 
recursive service on the same nameserver actually is. In our case 
splitting them is on the todo list, but I'm unable to get a feeling for 
the urgency....and what the real problems are (that won't be fixed in 
another release of bind :) ).

Gilles

--
RESTENA - DNS-LU
6, rue Coudenhove-Kalergi
L-1359 Luxembourg
tel: (+352) 424409
fax: (+352) 422473

[...]

also note that if you run authority and recursion in the same server image
(answering on the same ip address), there are a few cases where the server
cannot follow the RFC's when generating answers, and is basically 
guessing.

[...]