I just finished testing to quell my own paranoia, and www.doxpara.com reports my ASG as "appears to be safe" I'm running 7.201, and have only one DNS forwarder set to point to OpenDNS. (208.67.222.222)
I also changed my forwarder to point to a non-patched public DNS server, 4.2.2.1, and it then reported as being vulnerable. This seems to be different to what some commentors said on the previous DNS thread. I wonder if they still had forwarders from their ISP listed?
Just to be sure, I repeated the test several times, on a couple different networks/asgs and the results were the same in each case. Astaro does NOT appear to be vulnerable unless you point it to a non patched DNS server.
In unpatched servers, such as 7.201, you're only safe if you use a safe upstream server, e.g. opendns.
Kaminsky says that Verizon broadband and Comcast have patched, but that Timewarner, et al. are still patching. 4.2.2.x is Verizon/GTE, but maybe not part of Verizon broadband.
BTW, if you use OpenDNS, and you want NXDOMAIN returned for non-existent domains, you have to create a (free) account and change an option. This may be important, depending on how you do spam filtering, etc.
I have to agree... after this much time since the DNS announcements, a beta is not acceptable.
Also, I was under the impression that 6.3 was still supported for security-related issues. I know I'm still paying for support on 6.x.
The only reason I'm not a lot more upset right now is that the network behind ASL doesn't rely on DNS enough for dns spoofing to be able to severly affect us.
