HcIbd> What are DNS zone transfers???
"zone transfer" is one of several replication mechanisms that
can be used to replicate DNS database content across a set of
peer content DNS servers. It is the one such replication
mechanism that is common to all DNS server softwares. However,
it is also the most severely limiting of those mechanisms
because its fixed schema doesn't match the actual database
schemata of most DNS server softwares.
<URL:
http://www.microsoft.com/technet/pr...rver/sag_DNS_und_ZoneTransfers.asp?frame=true>
HcIbd> and why does my security Dept. think I need
HcIbd> to shut them off????
How can we know ? You need to be asking your "security
department" this question, not us. When it told you that it
wanted you to shut off "zone transfer" service, why didn't
you ask it "Why?" then and there ?
Ask your "security department" why. Its answer to this
question will be telling, and will reveal a lot about it.
If its answer is that it doesn't want people on the rest of
Internet to be able to obtain your DNS data by performing
"zone transfers", then your "security department" doesn't
understand the nature of publication. The data that your
DNS server serves up are _intended_ to be public. Preventing
"zone transfer" in order somehow to make those data "less
public" is just daft (especially in light of the existence of
"'NXT' walking"). If there's something that you don't want
published, it _should not be served up by your DNS server
at all_. It simply should not be in your ("external" view)
DNS database in the first place. Preventing "zone transfer"
does nothing to ameliorate the case where your DNS database
contains data that shouldn't be published.
If your "security department"'s answer, however, is that it
wants to prevent denials of service (since "zone transfer"
uses DNS/TCP and is subject to the same denials of service
that every other TCP/IP service is subject to), then it is on
firmer ground. That is a valid concern. However, what it
should be concentrating upon is preventing the use of DNS/TCP
entirely, and not fixating upon "zone transfer" (which is but
one of the uses of DNS/TCP), since it is DNS/TCP service that
is the actual avenue of attack, not "zone transfer" /per se/.
