Mitigation of server's load by queries for non-existing domains
johnmill at brandeis.edu
Wed Jan 13 16:34:04 UTC 2016
On Wed, Jan 13, 2016 at 8:35 AM, Tomas Hozza <thozza at redhat.com> wrote:
> On 12.01.2016 18:16, Tony Finch wrote:
>> Tomas Hozza <thozza at redhat.com> wrote:
>>> Recently I was trying to find a mechanism in BIND that could prevent the
>>> server from processing a recursive query for non-existing domains.
>> Have a look at https://www.isc.org/blogs/tldr-resolver-ddos-mitigation/
>>> I was thinking about using RPZ with QNAME policy trigger, but this
>>> applies only to the responses to queries and still makes the server to
>>> try to resolve it.
>> RPZ has a "qname-wait-recurse no" option.
> This is exactly the thing I was looking for.
> Thank you very much!
Thanks from this end as well--I wasn't aware of this option, either.
More information about the bind-users