Drop forwarded requests

[Danny Mayer]

Barry Margolin wrote:
> In article <fis8t9$trj$1 at sf1.isc.org>, gagadget at free.fr wrote:
> 
>> Hi listers,
>>
>> Is there a way to prevent BIND to answer frowarded requests ?
>>
>> For local uses, somebody has setup a DNS on our network ( very large network 
>> ),
>> his server is forwarding all requests it can't answer. We asked him several
>> times to shut down his server but he won't. For security reasons, we don't do
>> forwarding on our servers so we would like to deny his forwarded requests
>> without deny all his requests.
> 
> Do you mean you want to allow him to query your authoritative data, but 
> not use you as a caching server?  Use "allow-recursion" and 
> "allow-query-cache" to block him.

I would suggest that if you really want him to shut down his server you
have his boss tell him to do so. If this is really a security issue you
should be able to force this to happen. If this is a political issue
then you need to deal with it politically. Barry's answer is just a
technical answer. You hsven't said why his running his own DNS is a
problem for you.

Danny