Admitted, I haven't spent a huge amount of time doing DNS stuff, but I
believe that I know a bit about it.
In his slides about hardening the .dk infrastructure to Kaminsky-style
attacks, Ram Mohan had the following as a bullet point: "Randomize all source
ports for DNS responses".
While I don't disagree, that source port randomization for queries
makes a lot of sense, how in the world would it do anything for responses?
Firstly, it wouldn't work, since the recursive resolver expects the response
to come from the server/port it requested it from, and that means port 53.
