Re: DNS cache poisoning?

[<chad () mr-lew com>]

Let me clear up what I stated earlier...

Simply upgrading from a Windows NT based DNS to any BIND 
based DNS will not solve your problems...

How I SHOULD have said it:
1. Upgrade to the most current version of BIND 9 (9.3.1) 
that is available. (Stable version, not a RC) 
http://www.isc.org
2. Restrict other services on the box and harden the O/S.
3. Run named in a chroot environment with a restricted 
account.
4. Restrict the DNS functionality through your named.conf 
configuration. (i.e. restrict recursive queries, zone 
transfers, cache size, implement views, change default CHAOS 
version.bind txt record)
5. Check the security of any secondary name servers and any 
forwarders.
6. Blackhole offending networks via named.conf. (Be careful 
not to get "tricked" into adding innocent networks)
7. Use DNS to reduce banner-ads and/or worm traffic in your 
network if desired. (establish master zones and point them 
to loopback) http://www.deer-run.com/~hal/sysadmin/dns-
advert.html
8. Implement DNSSEC features if possible. (sign zone 
tranfers)

OR

If you have another version of DNS that will provide you 
with the security and functionality you need, and you can 
validate it is not susceptible to DNS Cache Poisoning via 
poorly randomized Query IDs, then use it. There are numerous 
other DNS software packages out there (DJBDNS, TinyDNS, 
MaraDNS, NSD, PowerDNS, UltraDNS, eNom DNS, Sinple DNS Plus, 
etc...)

Sorry for the confusion... ;-)