To respond to your upgrade to bind-4.9.6 or 8.1.1, I would go with 4.9.6 because I know of many bugs left in 8.1.1 that can harm a Name Server. When I get more information on this, I will release it to the list. One of the many bugs in it involves CNAME. I will talk to the person who released this information to me and get back to the list.
3a) What measures were taken (other than discussion of DNSSEC, or lack of it) to 'cure' affected servers?
upgrade to bind-4.9.6 or bind-8.1.1.
-- --- --- --- --- --- --- --- --- --- Steven Nash ph: (516)248-8400ext25 Systems Engineer / Network Security fax: (516)248-8897 Lightning Internet Services LLC email: snash@lightning.net http://www.lightning.net --- --- --- --- --- --- --- --- ---