DNS Consulting

DOMAIN NAME SERVER CONSULTING

DNS & BIND
CONSULTING

DNS ON LINUX, SOLARIS, WINDOWS
DNS server software is a key component in the successful management of a large enterprise, university, government or military website, email servers, and networks. We provide remote and onsite consulting in the installation and upgrading of your DNS software on UNIX (Linux and Solaris primarily), and Windows NT, 2000, 2003 servers.

Approximately 95% of the DNS servers on the Internet are vulnerable to hacker attacks or are severely out of date (Wall Street Journal) including servers run by ISPs. See the CERT advisory here. Even the versions of Berkeley Internet Name Domain (BIND) shipping with SUN, IBM and HP hardware are already out of date. Firewalls will not prevent these types of hacker attacks. Failure to update your DNS server software will leave your site vulnerable. We have been using and supporting the major implementation of DNS server software, ISC's BIND for over 10 years as part of our ISP. The latest version of BIND that is not vulnerable is 9. BIND 9 is a major rewrite of BIND and is now running on some of the root servers at the core of the Internet (via Network Solutions and others).

If you manage a corporate network, we recommend getting your DNS server software updated and configured properly and set up a regular maintenance program. We also recommend finding out if your ISP is vulnerable.

In our DNS reviews, we will conduct onsite audits, custom onsite compiling of source code and configuration of the server software to match your corporate specifications and match it to your security policies. We can also provide extensive training on our implementation of DNS software and configurations. Most zones files will need manipulation to match current specifications. Secondary (slave) DNS servers will take less time if we set up the primary DNS server and can match the server's named.conf file. Some engagements will last longer if we are configuring a company DNS server for the first time.

Please call 703-955-3688.

MORE DETAILS
Some of the services we can perform for your organization are as follows:
Creation of a SCOPE Document defining the work to be performed. This can be attached to the purchase order.
Setting up Name Service for the first time for a corporation,
   agency, or educational institution.
Converting DNS on NT to DNS on Windows 2003.
Converting DNS on NT to BIND 9 on Sun Solaris UNIXor LINUX.
Training DNS Admins to properly manage and update the DNS servers.
Setting up Name Servers to use NTP time servers.
Configuring Primary (master) and Secondary (slave) Servers
   with Host Authentication (TSIG with hmac-md5).
Configuring Dynamic Zones with ZONE Authentication keys (DSA).
Configure forwarding.
Converting existing Zones in BIND 4 or BIND 8 into BIND 9 format.
Updating a BIND 4 Configuration file to BIND 9 format.
Configuring IXFR between Hosts.

/*BIND 9.5 does IXFR (incremental) transfers between the master server and any secondary (slave) servers you may have (which is much faster then AXFR which transfers the entire zone). You can still transfer the whole zone if you want to and reload specific zones by themselves.*/

Cleaning up Zone information formats and simplifing them.
Checking Zone files for forward and reverse matching.
Configuring IP Black Hole Resolution for random unused IP Blocks used by spammers. Configuring Access Control Lists (acl) to protect the DNS servers in a DMZ.
Tuning performance of BIND servers.
Configuring your BIND server to support IPv6 DNS resolution.
(AAAA, A6 records and A6 chains)

ABOUT PETER BARTRAM
Peter Bartram is an expert on BIND 9 and DNS software. He has 15 years of experience using BIND DNS. He maintains the name servers at Imagine.com with BIND software using Linux and SUN Solaris.

He can work comfortably with your DNS Administrators and leave them with all of the powerful DNS or BIND tools at their disposal. Under BIND, servers will be time synced, with secure transmission of zone files between the servers (keys) and powerful granular control over zones. BIND offers anti-spoofing with granular control over queries and the option of allow-recursion of only your own IP blocks. Properly configured, it also does IXFR (incremental) transfers between the master server and any secondary (slave) servers you may have (which is much faster then AXFR which transfers the entire zone). You can still transfer the whole zone if you want to and reload specific zones by themselves remotely. Upgrading your DNS will go quickly and have a very positive impact on your network, website and peace of mind.