[dns-operations] Queries for isc.org/ANY/IN

Mon Jan 9 08:20:18 UTC 2012

On Mon, Jan 09, 2012 at 12:45:56AM +0100,
 Sebastian Wiesinger <dns-operations at ml.karotte.org> wrote 
 a message of 38 lines which said:

> There are the Top 10 clients for this query in the last 24 hours:

If it is (and it probably is) a DoS attack by amplification (the reply
to "isc.org ANY +dnssec" is large), then the source IP address is
forged. It is the address of the victim, not of the attacker.