large organization nameservers sending icmp packets to dns servers.

Tue Aug 7 20:33:22 UTC 2007

> This has been a pain for me for years. I have tried to reason with
> security people about this and, while they don't dispute my reasoning,
> they always end up saying that it is the "standard" practice and that,
> lacking any evidence of what it might be breaking, it will continue to
> be blocked. And I don't mean small companies, either. One of the biggest
> issues I have is with one of the countries largest government funded
> research labs.
Can someone, anyone, please explain to me why blocking TCP 53 is 
considered such a security enhancement? It's a token gesture and does 
nothing to really help improve security. It does, however, cause problems.

You have no way of knowing why a client might want or need to contact you 
via TCP 53 for DNS- so why would you block them?

The fact is most people, to this day, still believe that TCP 53 is only 
used for axfr's.

Someone was only too happy to point out to me that he would never create 
a record larger than 512 bytes so why should they allow TCP queries? The 
answer is simple- because they are supposed to be allowed. By disallowing 
them you are breaking the agreed upon rules for the protocol. Before 
long it becomes impossible to implement new features because you can't be 
sure if someone else hasn't broken something intentionally.

If you don't like the rules- then change the damned protocol. Stop just 
doing whatever you want and then complaining when other people disagree 
with you.

-Don