IPv6 rDNS

Crist Clark Crist.Clark at globalstar.com
Wed Nov 3 18:02:13 CDT 2010


>>> On 11/3/2010 at  1:10 PM, Lamar Owen <lowen at pari.edu> wrote:
> On Tuesday, November 02, 2010 02:21:14 pm Sven Olaf Kamphuis wrote:
>> getting rid of bind has various other advantages, such as no longer 
>> needing tcp to transfer "zone files" (Retarded concept to say the least) 
>> so there are no more "tcp issues" related to anycasting your authorative 
>> dns servers, as you can simply have them talk to your central database 
>> over their bgp session ip, which isn't anycasted, no more port 53/tcp 
>> therefore! yay, good riddance!
> 
> Performing zone transfers is not the only reason for 53/tcp; it can also be 
> needed for long (>512 byte) query responses.  Thanks to the one-two punch of 
> DNSSEC and IPv6, the probability of a DNS reponse needing TCP on port 53 is 
> much greater now.

That's mitigated by the fact EDNS0 is required for DNSSEC
allowing for larger queries to go over UDP.

Still, blocking 53/tcp is perhaps second only to dropping all
incoming ICMP in the quest to be the most widely deployed and
severely broken thing done in the name of Internet security. 
-- 

Crist Clark
Network Security Specialist, Information Systems
Globalstar
408 933 4387






More information about the NANOG mailing list