Ah, yes, didn't think of that. Though, I'm not sure if it's a problem. DNS by nature must be static. Unless something changes you certainly can block DNS addre

Ah, yes, didn't think of that. Though, I'm not sure if it's a problem. DNS by nature must be static. Unless something changes you certainly can block DNS addresses, and you can block it indiscriminately on all ports. I don't care what port or protocol used if my non trusted devices contact 8.8.8.8 on any port. If you rotate your resolvers, you'll have to push out a software update to update the DNS servers, which takes time and money.