Managing Mission - Critical Domains and DNS

Response-Rate Limiting (RRL)

RRL is standard issue in BIND and NSD now. The team behind PowerDNS also recently released dnsdist, which is a "DDoS-aware" DNS proxy layer with built-in RRL and packet filtering:

options {
        rate-limit {
        responses-per-second 5;
        };
};

RRL will prevent your nameservers from being used in an amplification or reflection attack by limiting how many responses it will send to each client.

When thresholds are exceeded by a client sending too many identical queries per second, the nameserver can be configured a variety of ways. It can send back a TC response, forcing the client to retry over TCP, it can not respond at all, or provide an occasional response known as a leaked response, governed by the leak rate parameters. ...