> >Are the queries refused because of the dot (.)? In the query log, I also > > found some 28 IN ANY queries from 7 IPs for xxx.at.fragolina.it, which > > probably got away with a NXDOMAIN. > > no. the dot is just the root domain.
Correct that . is the root domain, but I'd say the answer is a qualified yes. If you are not providing open recursive services and are not authoritative for the root domain, BIND will respond with REFUSED just like it would if someone asked you about example.com when you're not authoritative for that. In the old days you'd get a root referral for authoritative resolution, but now you get a minimal REFUSED to signal lack of authority for the question. -- tale _______________________________________________ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
