DNS Fixup/Inspect Pix/ASA 7.0 or greater breaking email

Hold on to that shirt ;-)

The reason the problem is selective is that only -some- providers try to return more than 512 bytes of DNS response; the ones that return the expected size get through, but the ones that return long responses have the response dropped, which is the same effect as if the DNS servers were down.

There shouldn't really be more than 512 bytes of DNS response, because UDP doesn't have any way of negotiating maximum packet size and DNS has to work with networks that can only support the old TCP/IP minimum maximum-packet-size of 576 bytes. For anything larger than that, rather than sending a larger response, the DNS server should be sending only the first 512 bytes of response and should be setting a "response truncated" flag in the response. Upon seeing the truncation flag, the client determines whether it was able to get the information it needed from what it was sent, and if the truncated information wasn't enough, the client is supposed to repeat the query but using TCP instead of UDP (the destination port number is the same either way.)

Unfortunately, some providers figure that since "everybody" supports

1500 byte packets these days, that they can just send back longer UDP DNS responses and the packet will get through anyhow, potentially saving an extra connection. That's mostly fine, but fails when you have a firewall inspection in place that knows about the protocol and knows that those longer packets shouldn't be there and figures that the longer packets are probably some kind of attack...

Excellent answer Walter.

Whats got me by the short hairs is that it worked fine thru a Pix 515 running 6.3(5) using "fixup protocol dns maximum-length 512". Put an ASA

5520 using that new fangled inspect.

policy-map type inspect dns preset_dns_map parameters message-length maximum 512 policy-map global-policy class inspection_default inspect dns preset_dns_map

Broke AOL, Comcast and a few others.....

Riddle me that batman!

EDNS0 is the protocol to negotiate a larger packet size für DNS. I do strongly recommend to enlarge this inspect to 4096 bytes.

You will break RIPE, *.se and a lot of other registries too. Because they are using DNSSec. If you never need reverse lookups on IP addresses, you can drop those answers by limiting DNS-packets to 512 bytes.

Your choice. Your broken network.