<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><span style="background-color: rgb(33, 33, 67);"><span style="color: rgb(27, 44, 72);"><span style="background-color: rgb(255, 255, 255);"><span>Dear,<br><br>We have Caching DNS server and certain PTR record(reverse entry verification purpose) only is allowed from internet. But I am observing suspicious DNS traffic from my BIND caching DNS server towards 67.215.80.15,67.215.80.13,207.192.69.4,67.227.239.85 IP address on destination port 1033,1090,1743, etc. Since we haven't allowed non standard port from our DNS server to public DNS server, its dropped in firewall.<br><br>Any idea as to why our company DNS server is contacting external IP on non standard port?</span></span></span><br></span><br> <br><span style="color: rgb(27, 44, 72);"><br>Below is the logs taken from DNS server on one of the destination IP
address.<br>############################################################################</span><br><br><br>client 67.215.80.15#58230: view localhost_resolver: query (cache) '109.232.12.217.in-addr.arpa/PTR/IN' denied<br>client 67.215.80.15#18395: view localhost_resolver: query (cache) '86.232.12.217.in-addr.arpa/PTR/IN' denied<br>client 67.215.80.15#34068: view localhost_resolver: query (cache) '114.232.12.217.in-addr.arpa/PTR/IN' denied<br>client 67.227.239.85#20915: view localhost_resolver: query (cache) '150.232.12.217.in-addr.arpa/PTR/IN' denied<br>client 67.227.239.85#64724: view localhost_resolver: query (cache) '232.12.217.in-addr.arpa/NS/IN' denied<br>client 67.227.239.85#16374: view localhost_resolver: query (cache) '150.232.12.217.in-addr.arpa/PTR/IN' denied<br>client 67.227.239.85#30391: view localhost_resolver: query (cache) '232.12.217.in-addr.arpa/NS/IN' denied<br>client 67.227.239.85#17745: view localhost_resolver: query (cache)
'150.232.12.217.in-addr.arpa/PTR/IN' denied<br>client 67.227.239.85#36163: view localhost_resolver: query (cache) '232.12.217.in-addr.arpa/NS/IN' denied<br>client 67.227.239.85#6391: view localhost_resolver: query (cache) '232.12.217.in-addr.arpa/NS/IN' denied<br>client 67.227.239.85#37586: view localhost_resolver: query (cache) '150.232.12.217.in-addr.arpa/PTR/IN' denied<br>client 67.227.239.85#55208: view localhost_resolver: query (cache) '232.12.217.in-addr.arpa/NS/IN' denied<br>client 67.227.239.85#40076: view localhost_resolver: query (cache) '232.12.217.in-addr.arpa/NS/IN' denied<br><br><span style="color: rgb(27, 44, 72);">Below is the firewall logs:<br>#########################</span><br>action=Deny sent=0 rcvd=112 src=our_company_DNS_server_ip dst=67.215.80.15 src_port=53 dst_port=16529<br>action=Permit sent=0 rcvd=0 src=67.215.80.15 dst=our_company_DNS_server_ip src_port=52370 dst_port=53 <br></div><div style="color: rgb(0, 0, 0); font-size:
16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">Regards</div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">Babu</div></div></body></html>