It is unfortunate that some current operating systems have poor random number generators. While this is improving, the machines used for key generation and use should be selected carefully. 10 Dynamic Update Dynamic update raises an issue regarding the protection of private keys. As mentioned earlier, one threat is the exposure of the private key. This is possible of the private key is on the same machine as the name server, or even on any other reachable server.
Dynamic update requires the server to sign data submitted to it for a zone.
To counter this, a recommendation is offered to segregate dynamic update zones from static zones. This limits the risk to static data if a dynamic update zone key is exposed. In addition, some issues have been discovered with signed dynamic update zones, particularly the mechanism by which to refresh signatures, which also call for separating crucial static data from dynamic data. This document does not place any requirements on the assigned numbers authority. This entire document is a note on security considerations.