using TCP53 for DNS

Wed Apr 27 07:21:31 UTC 2005

On Tue, Apr 26, 2005 at 12:39:09PM -0400,
 Patrick W. Gilmore <patrick at ianai.net> wrote 
 a message of 22 lines which said:

> From the thread (certainly not a scientific sampling), many people
> seem to be filtering port 53 TCP to their name servers.

Again, a non-scientific sampling but AFNIC (".fr" registry) *requires*
a successful technical check of the name servers *before* delegation
or technical change of a ".fr" domain. <soapbox>Every TLD should do
so.</soapbox>

Among the things we check is the TCP access to all the name servers.

A lot ("lot" is not a scientific word, I know) of people
complain. Very often, they are clueless ("TCP is only for zone
transfers"), very often also they don't master their infrastucture
(DNS hosted somewhere else, "firewall" middlebox which is an unmanaged
black box, "firewall" which is managed by an external contractor on a
per-change charge basis, etc).