Rob,
In fact, my DNS only faces AMPRNet (at 44.60.44.3); but I did have
TCP/53 opened in case someone wished to zone transfer (including
myself); or as Borja noted, uses TCP/43 for legitimate DNS requests.
I'll be closing TCP/53 to the Internet - NOW.
Thanks all,
- KB3VWG