Edit: This is not merely a question about DDOS, but a question about how to resolve a technical issue impacting only Mac clients of Outlook Anywhere.
Problem and solution are are now known, see comment added by me on the only answer for a link describing the problem and with a solution via power shell commandlets on Exchange
Original question follows...
I'm not a Mac user, nor the Windows Admin, so forgive me if I don't have the the nomenclature correct, but I'm trying to help another admin.
We run Active Directory and Exchange 2010. The name servers for our Internet top level domain are Linux with Bind. A subdomain like ad.example.com is the domain for AD, Exchange, etc.
In an attempt to prevent the DNS service on AD from being abused with DNS reflection DDOS attack method, port 53 was blocked at the firewall. It has the effect of blocking off site users with Mac Outlook from syncing with Exchange.
Blocking port 53 seemed the only way to go because disabling recursion on the Windows DNS causes failures to access the outside world, and unlike Bind, there is no feature like views.
Are other sites finding this is a problem, or does it hint of a configuration problem?
The admin mentioned that when traced, the connection information (perhaps with autodiscovery) came back with the address like exchange.ad.example.com, while the exchange server is also known as an address like exchange.example.com. He isn't sure if there is some place in the configuration to fix that. The idea being if we can get the "ad" out of the host name, the Mac Outlook client would not need to talk to the DNS on AD.
Our Goal: to block AD's DNS servers from DDOS abuse.
Our problem: Mac Outlook clients require access to AD's DNS when off site.