3 ms·
Interesting that they permit TCP port 53, rather than just UDP port 53.
by MaxBarraclough 7y ago
Interesting that they permit TCP port 53, rather than just UDP port 53.
- Piskvorrr 7y agoMy guess is that it stems from lax firewall defaults. "Allow port 53 - [tcp/udp/BOTH]?" (Yeah, I know that DNS can also work over 53/tcp, but it's rare compared to the 53/udp volume)
- acdha 7y agoIt's not as rare as it used to be a couple decades ago. If you block tcp/53 you will find a surprising number of things breaking as record sizes have increased over the years.
- kubanczyk 7y agoRFC7766 "Recursive server (or forwarder) implementations MUST support TCP so that they do not prevent large responses from a TCP-capable server from reaching its TCP-capable clients." large responses == some DNSSEC, some IPv6
- mercora 7y agoi think that is fine actually. however, if i would implement such thing i would probably redirect DNS traffic to my DNS server as long as you are not authenticated :)