A company is acquiring another organization that has a single DNS server that is accessible to the internet. What is a good recommendation for the acquiring organization?

Blocking UDP/53 would break standard DNS query resolution entirely, since the vast majority of DNS queries use UDP on port 53.

Split DNS infrastructure (split-horizon DNS) deploys separate DNS servers for internal and external queries, ensuring internal hostnames and IP addresses are never resolvable from the internet. This eliminates the exposure of internal network topology to outside parties. It also allows different responses to be served to internal versus external clients querying the same domain name.

Blocking TCP/53 would disrupt zone transfers and large DNS responses but would not address the core problem of a single publicly accessible DNS server exposing internal records.

Enabling zone transfers on the acquired server would allow any internet host to download the entire DNS zone, significantly worsening the security posture.