How does an untrusted interface at the boundary of an administrative domain handle incoming packets?

An untrusted interface at the network boundary, designed for ingress traffic from external sources, typically remarks all incoming QoS values to a default best-effort class, such as CoS 0. This ensures that the internal network does not implicitly trust or honor any external QoS markings, preventing potential abuse and maintaining control over local QoS policies.

An untrusted interface would not forward only traffic with a specific high DSCP value; its purpose is to regulate all incoming traffic.

While QoS systems can translate between IP Precedence and DSCP, the primary function of an untrusted interface is to reset or condition QoS markings, not just translate them.

An untrusted interface is designed to receive and process traffic, not to drop all incoming packets; dropping all traffic would prevent any external communication.