Mitigation of server's load by queries for non-existing domains
Tony Finch
dot at dotat.at
Tue Jan 12 17:16:20 UTC 2016
Tomas Hozza <thozza at redhat.com> wrote:
>
> Recently I was trying to find a mechanism in BIND that could prevent the
> server from processing a recursive query for non-existing domains.
Have a look at https://www.isc.org/blogs/tldr-resolver-ddos-mitigation/
> I was thinking about using RPZ with QNAME policy trigger, but this
> applies only to the responses to queries and still makes the server to
> try to resolve it.
RPZ has a "qname-wait-recurse no" option.
Tony.
--
f.anthony.n.finch <dot at dotat.at> http://dotat.at/
Rockall, Malin: Northwest becoming cyclonic later, 5 to 7 occasionally gale 8
at first. Rough or very rough, becoming moderate or rough. Rain or showers.
Moderate or good.
More information about the bind-users
mailing list