Keep Your DNS Functions Separate

Authoritative nameservers should never be recursive (caching).  Never run both types on the same IP.

See:

• djb : http://cr.yp.to/djbdns/separation.html
• http://www.squish.net/dnscheck/
• US-CERT publication “The Continuing Denial of Service Threat Posed by DNS Recursion (PDF)”