DNS behind a firewall

["Sanchez-Ayra, José"]

Hi all,

I've heard that BIND-8 uses a random port, not the fixed port-53, to querie
others name-serves. Is it correct?

If it's correct, I have my DNS in a DMZ behind a firewall, so have I to
accept "any" port from/to my DNS? This is a security hole to my DNS because
anybody could make a telnet, ftp ... connection.

           Internet
             |
             |
          Firewall--------------------------DMZ
                                   |
                                   |
                                 DNS

JSA