Re: Industry best practices (was Re: large organization nameservers

[Sean Donelan <sean () donelan com>]

Followups probably should go to the dnsops mailing list.

I got tired of things and went back to the original question, and put 
together my list of what the "minimum" packets needed for full DNS 
performance on the modern Internet.

It is the minimum, based on the security principle deny everything, allow
only what is needed. But "needed" is performance based. So it means not 
relying on fallbacks, timeouts or hoping no one complains. It does not 
include packets needed for diagnostic or troubleshooting information.
It is based on the "modern" Internet so does not included very deprecated 
packets like Source Quench or unimplemented functions like broadcast DNS
queries.

It does include current Internet practices for EDNS, Notify, global DNS 
load balancers and error handling I've seen in recent, i.e. less than 10 
years old, DNS, Router and OS software.

I didn't included TOS/DSCP and some military options, mainly because I'm 
not sure what "modern" military networks are currently using.  If you are
using TOS/DSCP or military options, there are some things you will need to 
add.

<http://www.donelan.com/dnsacl.html>
<http://www.donelan.com/dnsacl-min-cisco.html>