[There's a reason that Yoda is the unofficial mascot of SBS. Size indeed matters not.] DNS ...to forward or not to forward...that 'tis the question - THE OFFICIAL BLOG OF THE SBS DIVA
Sat, Mar 26 2005 13:50 bradley

DNS ...to forward or not to forward...that 'tis the question

First off I have to explain..I've been doing knock offs of Shakespeare ever since I briefly caught the interview of Denzel Washington on GMA in his role of Brutus in Julius Caesar on Broadway.....the “To Be or not To Be“ is from Hamlet anyway....we now return you back to the blog....

DNS ...to forward or not to forward...that 'tis the question...whether tis nobler in the mind to suffer the slings and arrows of potential DNS poisoning or to merely use root hints..... 

uh...sorry...where was I?  Oh yeah...

Muffy in the newsgroups indicates that when she ran the Connect to internet wizard that she 'did not' put in any ISP's DNS entries in there where the wizard indicated and the network is resolving to the Internet just fine.  Is this okay, she asks?

And yes, indeed as is showcased here it is truly not necessary to put in ISP forwarders...as the built in DNS root hints pick up the ball and just work.

In fact, many are now arguing that we should 'not' put in DNS forwarders anymore due to DNS poisoning attacks.  The only thing I have seen that we need sometimes is adjustments to EDNS0 support evidence by not being able to get to some websites.

So next time you are playing around with your test server... try taking out those forwarders...see what happens... you'll probably find like Muffy did that everything magically still works just fine.

P.S.  Check out Eric's comments for some items to think about when choosing between forwarding or no forwarding.

Filed under:

# re: DNS ...to forward or not to forward...that 'tis the question

Saturday, March 26, 2005 5:11 PM by bradley

There isn't a clear "right answer" here IMHO. If you use forwarders, you rely on the upstream DNS server to not get poisoned. But you also get the benefits of performance....less bandwidth you need to use, less time to go out and talk to a root server then work your way "down the chain" so to speak.

It's all about faith to some degree. If you consider that some % of your traffic is traveling unencrypted over the wire to that ISP, perhaps you already have some faith in them, and trust them for DNS. Perhaps you encrypt everything, and never trust your ISP. Perhaps you are just about protecting what you can, and see this as another step, even though you trust them for other things here.

No right answers here....just a lot of people that like to disagree. :)

# re: DNS ...to forward or not to forward...that 'tis the question

Thursday, March 31, 2005 8:28 PM by bradley

Funny you should bring this up now. There seems to be a major problem lately with SBSers who are using Verizon's DNS servers as forwarders (at least in the Boston area). Clearing the forwarder information off the SBS box seems to resolve the problem. I would urge anyone (especially Verizon customers) who is having trouble resolving names (but no trouble pinging by IP address) to try removing the forwarders to see if that fixes it.

# re: DNS ...to forward or not to forward...that 'tis the question

Wednesday, August 23, 2006 7:22 PM by Karina

Schwarzbrot macht Wangen rot, Weissbrot macht Leute tot.