8. Security Considerations (original) (raw)

Connected: An Internet Encyclopedia
8. Security Considerations

Up: Connected: An Internet Encyclopedia
Up: Requests For Comments
Up: RFC 2136

Prev: 7. Design, Implementation, Operation, and Protocol Notes
Next: Acknowledgements

8. Security Considerations

8.1. In the absence of [RFC2137] or equivilent technology, the protocol described by this document makes it possible for anyone who can reach an authoritative name server to alter the contents of any zones on that server. This is a serious increase in vulnerability from the current technology. Therefore it is very strongly recommended that the protocols described in this document not be used without [RFC2137] or other equivalently strong security measures, e.g. IPsec.

8.2. A denial of service attack can be launched by flooding an update forwarder with TCP sessions containing updates that the primary master server will ultimately refuse due to permission problems. This arises due to the requirement that an update forwarder receiving a request via TCP use a synchronous TCP session for its forwarding operation. The connection management mechanisms of [RFC1035 4.2.2] are sufficient to prevent large scale damage from such an attack, but not to prevent some queries from going unanswered during the attack.

Next: Acknowledgements

Connected: An Internet Encyclopedia
8. Security Considerations