1

I was reviewing the configuration of my Microsoft DNS server by executing dnscmd localhost /exportsettings and then going through the C:\Windows\system32\dns\DnsSettings.txt file. As I understood the SecureSecondaries displays the the zonetransfer settings. If it is set to 0 (meaning "Disable secondary security. Send zone transfers to all secondary servers that request them."), it is a security risk as discussed here (it can reveal sensitive information about the network topology).

However in the DnsSettings.txt file SecureSecondaries is set to 0 for the Cache zone:

[Zones]

Cache=Cache,AD-integrated
*removed*


[Cache]

Type=Cache
Store=AD-integrated
AllowUpdate=0
ZoneDN=DC=RootDNSServers,cn=MicrosoftDNS,DC=*removed*
DirectoryPartition=*removed*
SecureSecondaries=0
Secondaries=NULL
NotifyList=NULL

However I can not find where it can be disabled in the DNS Manager application, and the command given by Microsoft: dnscmd localhost /ZoneResetSecondaries Cache /NoXfr returns Command failed: DNS_ERROR_ZONE_DOES_NOT_EXIST 9601 0x2581.

Is DNS zone transfer really enabled for the Cache zone, or as Cache is not a master zone it can not be enabled at all? If it is enabled, how can I disable it?

0

The Cache is not a zone. It's merely a placeholder for the current list of DNS root servers. Hence the error you see... dnscmd can't find a zone called "cache". It's real name is "." but is still not a real zone just a special boot-strapping construct. So secondary settings don't matter.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.