[nsp-sec] Port 53 Blocking on DSL/Cable Networks

[Joe Abley]

On 31-Jan-2008, at 13:16, <jonathan.curtis at bell.ca> <jonathan.curtis at bell.ca 
 > wrote:

> Has anyone taken a serious look at blocking these ports externally on
> their networks?
>

> Reasons I ask:
>
> 1. Prevent Home Gateway Pharming / Phishing
>
> http://www.news.com/8301-10789_3-9855195-57.html
>
> http://www.cert.org.mx/imagenes/dns.png

Blocking 53/udp is a really bad way to try and fix that problem.

> 2. Protect TLD's and Root Servers from direct attacks from Cable - DSL
> customers

Speaking as the operator of a dozen or so TLDs, I'd rather get the  
traffic than have to try and deal with the multi-layer troubleshooting  
nightmare that widespread 53/udp blocking might cause.


Joe