[dns-operations] First experiments with DNS dampening to fight amplification attacks

Sean Leach sleach at wiggum.com
Fri Sep 28 12:28:09 UTC 2012

On Fri, Sep 28, 2012 at 1:44 AM, bert hubert <bert.hubert at netherlabs.nl> wrote:
> On Fri, Sep 28, 2012 at 09:17:42AM +0200, Dan Luedtke wrote:
>> When an IP address is blocked, we still answer to it, but only once[1].
>> Regardless of what the query is, we answer:
>>       TXT "temporary_blocked <challenge_1> <challenge_2>"
> Hmmm for authoritative servers, we might also emit a CNAME "challenge". This
> would be a needless and semantically null transition, but only a bona fide
> resolver will come back to follow the CNAME trail.

Arbor has something very similar to this in their DDOS products.

More information about the dns-operations mailing list