DNS forward only: why does it help?

[Paul Szabo <psz () maths usyd edu au>]

As a workaround, it is recommended to set DNS servers to forward only.
Can someone explain why that helps? Cannot responses from the forwarder
be spoofed same as normal query responses? Is it that "glue RRs" from
forwarders are discarded; or that source ports of forwarded requests are
better randomized than normal queries; or that forwarding is done with
TCP not UDP?

The "published attack" has ns.victim.com spoofed. That does not affect a
server set to forward only. Could the attacker spoof login.victim.com
directly, and would not that affect a forward only server equally?

Thanks,

Paul Szabo   psz () maths usyd edu au   http://www.maths.usyd.edu.au/u/psz/
School of Mathematics and Statistics   University of Sydney    Australia

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/