I’m trying to setup a new external DNS/Nameserver that queries multiple DirectAdmin servers. I’ve used BIND9 with forwarders to set this up and it works fine (with recursion enabled). The forwarders are only IP’s of servers where i host my websites on (no Google DNS or something). And when i check http://openresolver.com/?ip=dns1.chaseweb.nl it says that it isn’t vulnerable to DNS Amplification attacks.
I would like to know if this setup is safe enough to use in production or is it still vulnerable to DNS Amplification attacks or other attacks?
Looking forward hearing from the specialists over here!
(it’s now on a local box but i will move it to DO when it’s safe/ready)
Thanks,
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
Hi!
As long as your DNS server responds only to domains that you host, you should be fine. It’s basically the same as using DirectAdmin’s authoritative DNS servers directly, except with a proxy in the middle. That should be safe enough, as long as you:
- Only allow it to forward requests to your own authoritative DNS servers
- Disable recursion on the said DNS servers.
Become a contributor for community
Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.
DigitalOcean Documentation
Full documentation for every DigitalOcean product.
Resources for startups and SMBs
The Wave has everything you need to know about building a business, from raising funding to marketing your product.
The developer cloud
Scale up as you grow — whether you're running one virtual machine or ten thousand.
Get started for free
Sign up and get $200 in credit for your first 60 days with DigitalOcean.*
*This promotional offer applies to new accounts only.