Incoming traffic on port 53 to a client from a DC/DNS server

Question

_{Friday, January 11, 2019 11:07 AM}

Hi all,

Just opening up my Windows Firewall log to have a look and i spotted the below. I can see the traffic is dropped but does anyone have any idea why a domain controller and DNS server would be initiating traffic on port 53 (DNS) to my client machine?

#Version: 1.5
#Software: Microsoft Windows Firewall
#Time Format: Local
#Fields: date time action protocol src-ip dst-ip src-port dst-port size tcpflags tcpsyn tcpack tcpwin icmptype icmpcode info path

2019-01-11 10:52:17 DROP UDP 10.90.38.5 10.90.50.61 53 57205 175 - - - - - - - RECEIVE
2019-01-11 10:52:17 DROP UDP 10.90.38.5 10.90.50.61 53 64000 153 - - - - - - - RECEIVE
2019-01-11 10:52:17 DROP UDP 10.90.2.50 10.90.50.61 53 58354 166 - - - - - - - RECEIVE
2019-01-11 10:52:18 DROP UDP 10.90.38.5 10.90.50.61 53 57203 113 - - - - - - - RECEIVE
2019-01-11 10:52:18 DROP UDP 10.90.38.5 10.90.50.61 53 51592 92 - - - - - - - RECEIVE

** Edit **

This is the firewall log for the public profile

OS Windows 10 Pro 1809 x64

All replies (4)

_{Monday, January 14, 2019 9:37 AM ✅Answered}

Hi,

Thanks for your question.

According to my knowledge, I think it is a normal phenomenon. 

For example, the steps of DNS query.

Resolver will return ip address to your browser after it knows the IP address for the domain name in your query.

Therefore, there will be traffic generated.

Best Regards,

Eric

Please remember to mark the replies as answers if they help and unmark them if they provide no help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

_{Wednesday, January 16, 2019 8:57 AM}

Hi,

Just checking in to see if the information provided was helpful.

Please let us know if you would like further assistance.

Best Regards,

Eric

Please remember to mark the replies as answers if they help and unmark them if they provide no help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

_{Friday, January 18, 2019 8:36 AM}

Hi,

Was your issue resolved?

If you resolved it using other’s reply, please "mark it as answer" to help other community members find the helpful reply quickly.

If you resolve it using your own solution, please share your experience and solution here. It will be very beneficial for other community members who have similar questions.

If no, please reply and tell us the current situation in order to provide further help.

Best Regards,

Eric

Please remember to mark the replies as answers if they help and unmark them if they provide no help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

_{Friday, January 18, 2019 9:06 PM}

Hi Eric,

Sorry, had a few busy days at work. Your explanation was OK. it gave me enough info to further look around on the internet.