North American Network Operators Group
Date Prev | Date Next |
Date Index |
Thread Index |
Author Index |
Historical
Re: I don't need no stinking firewall!
- From: Tony Finch
- Date: Wed Jan 06 09:39:57 2010
On Tue, 5 Jan 2010, Kevin Oberman wrote:
>
> I suspect at least part of this will soon get fixed due to DNSSEC.
> Blocking tcp/53 and packets over 512 bytes will cause user complaints
> and, after enough education, the problem will get fixed.
Yes. Remember the root zone is due to be signed within the next six
months, and many nameservers (BIND in particular) request DNSSEC data by
default. You WILL have to deal with large DNS replies SOON - the first
ones from the root servers will appear this month.
http://www.root-dnssec.org/
Tony.
--
f.anthony.n.finch <dot@dotat.at> http://dotat.at/
GERMAN BIGHT HUMBER: SOUTHWEST 5 TO 7. MODERATE OR ROUGH. SQUALLY SHOWERS.
MODERATE OR GOOD.
|
