<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On Jan 5, 2015, at 3:17 PM, Alexander Neilson <<a href="mailto:alexander@neilson.net.nz">alexander@neilson.net.nz</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><br class="Apple-interchange-newline"><br class="" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><blockquote type="cite" class=""><div class="">On 6/01/2015, at 11:59 am, Franck Martin <<a href="mailto:fmartin@linkedin.com" class="">fmartin@linkedin.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div class=""><br class="Apple-interchange-newline">On Jan 4, 2015, at 2:44 AM, Alexander Neilson <<a href="mailto:alexander@neilson.net.nz" class="">alexander@neilson.net.nz</a>> wrote:</div></div><div class="" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><br></div></div></blockquote><br class=""><blockquote type="cite" class=""><div class=""><div class="" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><br class=""><blockquote type="cite" class=""><div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div class=""><br class=""><blockquote type="cite" class=""><div class=""><br class=""><blockquote type="cite" class="">* Resolved Fragmentation issues to allow full 4096 EDNS resolution<br class=""></blockquote>The best ;-). It seems like you already learned a lot and have taken the right decisions.<br class=""></div></blockquote><div class=""><br class=""></div><div class="">I am doing my best to try improve all aspects of our network. However the learning is what I really value out of it all as every change I make helps me to understand how it all works in the plumbing.</div></div></div></blockquote><div class=""><br class=""></div>You may find some useful documentation here if you worry about your network and not DNS only: <a href="https://www.m3aawg.org/published-documents" class="">https://www.m3aawg.org/published-documents</a></div><div class="" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><br class=""></div></div></blockquote><div><br class=""></div><div>Thank you, more resources on networks all over (DNS or otherwise) are always welcome. Trying to learn more to be a better network operator.</div><br class=""></div></blockquote></div><br><div>The big rule, is block port 25 traffic outside your network for all dynamic IP customers or end customers by default (they can use the submission port). Monitor this traffic as it will help you locate infected machines from your customers.</div><div><br></div><div>Make sure that any of your IPs has an attached working abuse email address. It is set up via the APNIC interface, gets visible in the whois but is surfaced via free and easy to use services like <a href="https://abusix.com/contactdb.html">https://abusix.com/contactdb.html</a></div><div><br></div><div>It makes reporting issues very easy (like DNS amplification attacks) and automatic, data you will want to have to keep your network cleaner, react to issues faster and contribute to world peace :P</div><div><br></div><div>Learn about <a href="http://spamhaus.org">spamhaus.org</a>, <a href="http://surbl.org">surbl.org</a>, <a href="http://uribl.org">uribl.org</a>, <a href="http://spamcop.net">spamcop.net</a>, <a href="http://sorbs.net">sorbs.net</a>, <a href="http://shadowserver.org">shadowserver.org</a> ….</div><div><br></div><div>Finally check:</div><div><a href="https://dmarcian.com/spf-survey/neilson.net.nz">https://dmarcian.com/spf-survey/neilson.net.nz</a></div><div><a href="https://dmarcian.com/dmarc-inspector/neilson.net.nz">https://dmarcian.com/dmarc-inspector/neilson.net.nz</a></div><div><br></div><div><br></div></body></html>