Blocking TCP

[Jim Reid]

>>>>> "Tilo" == Tilo Lutz <TiloLutz at gmx.de> writes:

    Tilo> I'm using bind9 I've read in a Firewall book TCP is only
    Tilo> used to do zonetransfers.  So I only allow the secondary DNS
    Tilo> to do zonetransfers.  But since that many request via TCP
    Tilo> are blocked by my firewall.  Is it OK blocking these
    Tilo> requests or ist it "unhealthy" ?

Preventing TCP queries is simply wrong. In the DNS TCP is not just
used for zone transfers.