Bind

A few Bind tips and tricks.

Avoid DNS Rebinding attack

Put this in the resolver / internal view section.

	deny-answer-addresses {
		// Unconfigured
		0.0.0.0;
		// RFC 1918
		10.0.0.0/8;
		172.16.0.0/12;
		192.168.0.0/16;
		// RFC 3927
		169.254.0.0/16;
		// IPv6
		// :: to ::ffff:ffff:ffff. 
		// Includes ::, ::1, IPv4-Compatible IPv6 Address ::/96
		// and IPv4-mapped IPv6 addresses ::ffff:0:0/96 
		::/80;
		// RFC 6052
		64:ff9b::/96;
		// Reserved for Documentation
		2001:db8::/32;
		// Unique local
		fc00::/7;
		// Link local
		fe80::/10;
		// Site local
		fec0::/10;
		// Your own addresses go below
		Your own addresses go here;
	} except-from {
		"Your own domains go here";
	};
	deny-answer-aliases {
		"Your own domains go here";
	};

Forward zone

When you want a forwarder, but only for a specific zone.

        zone "example.org" {
                type forward;
                forwarders {
			2001:db8:1234:1::1;
			192.0.2.1;
		};
	};

Disable validation

When Bind complains about a broken trust chain.

	validate-except {
		example.org;
	};