Re: Pubstro rash

[Jeff Kell <jeff-kell () utc edu>]

Joshua Berry wrote:
> I have never had a DNS query that had a response that was over 512
> bytes.  For that reason I disable all inbound DNS over 53/tcp.  I have
> been using this configuration for years and even run my own DNS servers
> and have see absolutely no problems.

If you aren't authoritative over a zone that requires large response 
records, you'll never receive one.  But you may very well send some 
queries out yourself (you allow 53/tcp outbound statefully?)

But in more general terms:

http://www.maradns.org/dnstcp_security.html
http://support.microsoft.com/default.aspx?scid=kb;en-us;828263
http://support.microsoft.com/kb/832223
http://www.certcities.com/editorial/columns/print.asp?EditorialsID=144
https://lists.netfilter.org/pipermail/netfilter/2002-January/029765.html
http://www.faqs.org/rfcs/rfc3226.html

(Among others).

Jeff