Best Practice Detail

13-12-8048

Network Operators, Service Providers, Equipment Suppliers and Public Safety should mitigate the possibility of DNS cache poisoning by using techniques such as 1) Preventing recursive queries, 2) Configure short (2 day) Time-To-Live for cached data, 3) Periodically refresh or verify DNS name server configuration data and parent pointer records. Service Providers, Network Operators, and Equipment Suppliers should participate in forums to define an operational implementation of DNSSec. This applies to Public Safety only in an NG9-1-1 environment.

Status: Rollover New

References/Comments: RFC-1034, RFC-1035, RFC-2065, RFC-2181, RFC-2535, ISC BIND 9.2.1 US-CERT \"Securing an Internet Name Server\" (http://www.cert.org/archive/pdf/dns.pdf).

Historical events:

Network Operators
Service Providers
Equipment Suppliers
Public Safety
Internet/Data
Cyber Security
Network Design
Network Elements
Network Operations
Public Safety Service
CSRIC VII: Rollover New In CSRIC VII