My company's ISP has implemented what I'll term DNS "grey listing" (or they have a configuration problem) - they are blocking inbound DNS queries between [resolver IP, server IP] pairs that haven't attempted a query in the last 60 seconds. So the if the first query fails, further queries succeed so long as less than 60 seconds have passed since the previous attempt. I assume this is to hide hosts from scans, under the assumption that a legitimate resolver will retry the query. They may even be blocking all UDP packets to combat port scans, but I haven't found a way to test this yet.
It turns out that Cisco IronPort devices generally have a retry interval longer than 60 seconds. (15 seconds to try each secondary DNS server, then 60 seconds before retrying the primary) My company can't receive email from most organizations with IronPort devices.
My feeling is that at least one of these behaviors is just wrong. So my questions are:
1) What are the recommended retry intervals for DNS resolvers? Can you reference an RFC or other source, or is it a de facto industry standard?
2) Is DNS or UDP "grey listing" a standard practice? References?
EDIT - Some additional background details:
Both of my company's DNS servers are affected, as is our ISP's primary nameserver. Their secondary nameservers, which actually reside outside their network, and nameservers upstream from any affected hosts are not affected. We also have a second ISP, and DNS queries that come in through that route are not blocked. Packet traces on our external firewall shows that we answer all DNS queries received - the dropped queries aren't delivered to our networks. My main goal in asking this question is to have a standards document to show our ISP (or less likely, Cisco) that their behavior is broken and needs to be fixed.