I have an Arch Linux mail server that is directly connected to the internet, and firewalled appropriately with iptables (default DROP on the single ethernet interface, allow only necessary ports). From time to time in a packet trace on the internet interface, I see the following:

Where 50.252.x.x is my mail server. The source is always a random IP address, and is usually an ICMP "port 53 unreachable" message.

I always figured that this is an attempt by someone to try and somehow redirect my system to use their DNS server (because of the port 53 reference), or at least to get my system to respond to it in some way. Is this likely to be what is happening? Are there systems out there that will respond to this kind of spoof technique?

Your best bet is to make sure your server kernel will never be able to respond to such requests. Enabling some basic TCP/IP Stack hardening using a sysctl config will prevent your system from responding. Configure and forget.

Here is some Arch documentation:

https://wiki.archlinux.org/index.php...tack_hardening

You will receive all sorts of malformed packets and requests on a server such as yours. The best thing you can do is minimize the possibility that your server will respond to such requests.

Additionally, if you set up your firewall to ignore certain packet types, you will have less problems too. Here is an IPTables script that I use as a starting point on fresh installations of Slackware servers.

https://github.com/BrentonEarl/Iptab...er/rc.firewall