IIRC dnsmasq still listens on all interfaces for some reason
I thought DNS was connectionless? Don't all DNS clients have to bind to UDP port 53 to function correctly?
It's not the port that matters; it's the interface. A caching DNS service for a simple desktop experience should only be listening for queries on the localhost interface (lo).
Which is exactly the issue I mentioned.
You get on some distros by default something that that makes you subject to DNS amplification attacks.
It is supposed to reject requests from the addresses it does not listen on. I just found it strange that it binds on all interfaces regardless.
I’ve noticed it respond with an error packet – which ended up being used for DNS Amplification nonetheless.