DNS port 1053

[OroITDirector]

I have a w2k sp4 fully patched server that is accepting dns packets on port 1053. Why is it not using port 53? should i be concerned with virus or malware activity trying to pollute my dns server? my firewall shows the dns packet being accepted from one of the forwarders on the dns list.

 

[Hondy]

how do you know its a DNS packet? Just because it comes from the forwarder doesn't mean its a DNS packet. If its talking DNS then isn't it more likely that the request is coming from 1053 (source ports are always dynamic) TO the forwarder and the DNS server is merely doing its standard TCP convo from 1053 to 53?