[120931] in North American Network Operators' Group
Re: I don't need no stinking firewall!
daemon@ATHENA.MIT.EDU (Tony Finch)
Wed Jan 6 09:39:59 2010
Date: Wed, 6 Jan 2010 14:39:19 +0000
From: Tony Finch <dot@dotat.at>
To: Kevin Oberman <oberman@es.net>
In-Reply-To: <20100106005541.5E3F61CC0B@ptavv.es.net>
Cc: NANOG list <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Tue, 5 Jan 2010, Kevin Oberman wrote:
>
> I suspect at least part of this will soon get fixed due to DNSSEC.
> Blocking tcp/53 and packets over 512 bytes will cause user complaints
> and, after enough education, the problem will get fixed.
Yes. Remember the root zone is due to be signed within the next six
months, and many nameservers (BIND in particular) request DNSSEC data by
default. You WILL have to deal with large DNS replies SOON - the first
ones from the root servers will appear this month.
http://www.root-dnssec.org/
Tony.
--
f.anthony.n.finch <dot@dotat.at> http://dotat.at/
GERMAN BIGHT HUMBER: SOUTHWEST 5 TO 7. MODERATE OR ROUGH. SQUALLY SHOWERS.
MODERATE OR GOOD.
