I don't need no stinking firewall!

[dot at dotat.at (Tony Finch)]

On Tue, 5 Jan 2010, Kevin Oberman wrote:
>
> I suspect at least part of this will soon get fixed due to DNSSEC.
> Blocking tcp/53 and packets over 512 bytes will cause user complaints
> and, after enough education, the problem will get fixed.

Yes. Remember the root zone is due to be signed within the next six
months, and many nameservers (BIND in particular) request DNSSEC data by
default. You WILL have to deal with large DNS replies SOON - the first
ones from the root servers will appear this month.

http://www.root-dnssec.org/

Tony.
-- 
f.anthony.n.finch  <dot at dotat.at>  http://dotat.at/
GERMAN BIGHT HUMBER: SOUTHWEST 5 TO 7. MODERATE OR ROUGH. SQUALLY SHOWERS.
MODERATE OR GOOD.