<html><head>
<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type">
</head><body style="font-family: tt; font-size: 11pt;" bgcolor="#FFFFFF"
text="#000000"><div style="font-size: 11pt;font-family: tt;"><br><br>bert
hubert wrote:<blockquote
cite="mid:20140403083809.GA10176@xs.powerdns.com" type="cite"><pre wrap="">Hi everybody,
Like most people, we're currently seeing loads and loads of malicious DNS
traffic. In this post
<a class="moz-txt-link-freetext" href="http://blog.powerdns.com/2014/04/03/further-dos-guidance-packages-and-patches-available/">http://blog.powerdns.com/2014/04/03/further-dos-guidance-packages-and-patches-available/</a>
we describe a new PowerDNS feature that so far has been remarkably
effective. I think it was inspired by a feature from Unbound, but unsure. It
was contributed to us by PowerDNS user Paulo Anes (thanks!).
What this filter does is keep tabs on authoritative servers that don't answer. After not
answering for X times in a row, the server gets blacklisted for Y seconds.
Then, after Y seconds the server gets a new chance to answer. If it doesn't,
it immediately gets blacklisted again for Y seconds. However, if it provides
only a single answer (even if incorrect), the blacklisting gets removed.
...</pre></blockquote><pre wrap="">
two questions:
</pre>if all of the servers for the closest enclosing zone cut are on
the dynamic server blacklist, do you SERVFAIL the query?<br><br>do you
keep track of servers by NS name, or A/AAAA address?<br><br>do you also
blacklist a server who sends SERVFAIL, and if so do you follow this text
from RFC 2308?<br><br><div style="margin-left: 40px;"><span><p
class="MsoNormal" style="page-break-before:always"><span
style="font-family:"Courier New"">In either case a resolver
MAY cache a server failure response. If it<o:p></o:p></span></p><p
class="MsoNormal" style="page-break-before:always"><span
style="font-family:"Courier New"">does so it MUST NOT cache
it for longer than five (5) minutes, and it<o:p></o:p></span></p><p
class="MsoNormal" style="page-break-before:always"><span
style="font-family:"Courier New"">MUST be cached against
the specific query tuple <query name, type,<o:p></o:p></span></p><p
class="MsoNormal" style="page-break-before:always"><span
style="font-family:"Courier New"">class, server IP
address>.<o:p></o:p></span></p></span></div><span><p
class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p></span>vixie<br></div></body></html>