Re: I don't need no stinking firewall!

On Tue, 5 Jan 2010, Kevin Oberman wrote:

I suspect at least part of this will soon get fixed due to DNSSEC. Blocking tcp/53 and packets over 512 bytes will cause user complaints and, after enough education, the problem will get fixed.

Yes. Remember the root zone is due to be signed within the next six months, and many nameservers (BIND in particular) request DNSSEC data by default. You WILL have to deal with large DNS replies SOON - the first ones from the root servers will appear this month. http://www.root-dnssec.org/ Tony. -- f.anthony.n.finch <dot@dotat.at> http://dotat.at/ GERMAN BIGHT HUMBER: SOUTHWEST 5 TO 7. MODERATE OR ROUGH. SQUALLY SHOWERS. MODERATE OR GOOD.