From owner-freebsd-stable@FreeBSD.ORG  Sat Dec  7 07:18:05 2013
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id BF5B2E10
 for <freebsd-stable@freebsd.org>; Sat,  7 Dec 2013 07:18:05 +0000 (UTC)
Received: from rush.bluerosetech.com (rush.bluerosetech.com
 [IPv6:2607:fc50:1000:9b00::25])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (No client certificate requested)
 by mx1.freebsd.org (Postfix) with ESMTPS id 7973F1949
 for <freebsd-stable@freebsd.org>; Sat,  7 Dec 2013 07:18:05 +0000 (UTC)
Received: from chombo.houseloki.net (c-71-236-222-167.hsd1.wa.comcast.net
 [71.236.222.167])
 by rush.bluerosetech.com (Postfix) with ESMTPSA id 26E4111434;
 Fri,  6 Dec 2013 23:18:04 -0800 (PST)
Received: from [IPv6:2601:7:1680:365:4055:e8ed:3d40:2f96] (unknown
 [IPv6:2601:7:1680:365:4055:e8ed:3d40:2f96])
 by chombo.houseloki.net (Postfix) with ESMTPSA id 16A6B9C7;
 Fri,  6 Dec 2013 23:18:01 -0800 (PST)
Message-ID: <52A2CB99.5050900@bluerosetech.com>
Date: Fri, 06 Dec 2013 23:17:45 -0800
From: Darren Pilgrim <list_freebsd@bluerosetech.com>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
 rv:24.0) Gecko/20100101 Thunderbird/24.1.1
MIME-Version: 1.0
To: Mark Andrews <marka@isc.org>
Subject: Re: BIND chroot environment in 10-RELEASE...gone?
References: <529D9CC5.8060709@rancid.berkeley.edu>
 <20131204095855.GY29825@droso.dk>
 <alpine.BSF.2.00.1312041212000.2022@badger.tharned.org>
 <E915D8A5-1CD0-465B-BAD1-59C45C9415F4@gid.co.uk>
 <20131205193815.05de3829de9e33197fe210ac@getmail.no>
 <20131206143944.4873391d@suse3> <20131206220016.BADCAB556F4@rock.dv.isc.org>
 <1386367748.17212.56515229.7C50AFEB@webmail.messagingengine.com>
 <20131206223300.89253B55861@rock.dv.isc.org>
In-Reply-To: <20131206223300.89253B55861@rock.dv.isc.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: freebsd-stable <freebsd-stable@freebsd.org>
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.17
Precedence: list
Reply-To: freebsd-stable <freebsd-stable@freebsd.org>
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-stable>,
 <mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable/>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
 <mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 07 Dec 2013 07:18:05 -0000

On 12/6/2013 2:33 PM, Mark Andrews wrote:
> In message <1386367748.17212.56515229.7C50AFEB@webmail.messagingengine.com>, Ma
> rk Felder writes:
>> On Fri, Dec 6, 2013, at 16:00, Mark Andrews wrote:
>>>
>>> But they should all be running a resursive validating resolver on
>>> every box.
>>
>> Are you *really* suggesting that I should run a recursive validating
>> server on every single server I admin?
>
> I'm suggesting that it should be run on *every* machine in the
> world, until all the applications that use data from the DNS have
> been upgraded to validate the data they get from the DNS, need to
> be be running a validating resolver.

Yes, everything needs a validating resolver; but everything only needs 
something behind getaddrinfo() that validates the responses provided by 
the servers listed in /etc/resolv.conf.  BIND and Unbound do not operate 
as forwarding servers by default and we really do not want everything 
running its own root-hinted resolver.