DNS Resolver and Request Port Filtering

No, it is not a safe assumption. Do not try to filter on ports, this won't yield useful consequences. How a client handles its local ports it is its own business and hence as a server you can expect to get traffic from all ports. The Unix split at 1024 is an archaic legacy of the past that means nothing anymore basically today.

If you want to combat DNS amplification, besides "standard" measures (like making sure you really need to handle all the traffic that you get, that is you are not wide open), one of the most often used way nowadays is RRL or basically rate limiting.

Look at https://www.infoblox.com/dns-security-resource-center/dns-security-solutions/dns-security-solutions-response-rate-limiting-rrl/ for an introduction on the subject and at https://www.isc.org/docs/DNS-RRL-LISA14.pdf for a more technical presentation.


DNS clients should have source port of > 1023.

If it is < 1024 it should only be source port 53 if it comes from some other DNS server - but that is unlikely.

Verify with tcpdump port 53

By looking at RFC6056 and simplification with some samples we might go further and say that any well behaving IP stack should not have (had) a source port lower than 49152 (first ephemeral port). However section 3.2 contradicts this, and so does the samples.

But until anyone can provide reference to RFC that redefines RFC6056, it is safe to say that sport <= 1023 is not valid.

If there for some reason is a request that fails, the client should retry, and hopefully get a successful request. (Even if this would fail, I would ignore those implementations)