Some queries will revert to a TCP response, it happens with SOA sometimes depending on the response size. In such a case it would fail and the user would never email you if there was a problem. I understand your trick and think it's just fine if that's what you want. Also, any query against a root domain with the type set to "any" (Windows users suffer from this more often than unix users when they perform nslookup searches instead of dig searches because they do not have the dig utility) and the server will nearly always revert to TCP for the response.
I like your idea for an internet facing DNS but you have to admit that it's not RFC compliant because it does block legitimate DNS traffic. It's the exception to the rule. Changing the plugin description for such an anomaly is potentially confusing to everyone but your site. No? Regards, -- Dan Daniel Bowman Director of Support & ITS Tenable Network Security http://www.tenablesecurity.com/ -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jason Haar Sent: Thursday, August 31, 2006 14:45 To: [email protected] List Subject: Re: I'll argue the wording on 18356... Michel Arboi wrote: >> We run tinydns and ensure our DNS records are always small enough to >> fit within a single UDP packet >> > > I understand the trick, but can you be sure of the behaviour of the > remote client software? > You're saying there are DNS clients out there that *default* to TCP for DNS lookups??? We've been running this "trick" for many years now. Never heard of anyone not being able to connect to our MX records, DNS servers, Web servers, etc, etc (of course, we never would hear from anyone having a problem ;-) -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 _______________________________________________ Nessus mailing list [email protected] http://mail.nessus.org/mailman/listinfo/nessus
