On Jun 4, 2014, at 1:09 AM, Peter van Dijk <[email protected]> wrote:

>> I decided to pair up DNSChain with PowerDNS recursor thinking that maybe 
>> since it has been in development for a long time now that it more 
>> effectively deal with this problem, however, it seems that it's only 
>> marginally doing so.
> 
> We understand from other communications that you are forwarding all queries 
> to Google DNS. The mitigation in PowerDNS Recursor is based on noticing 
> queries to remote servers are failing. If it was working in this case, it 
> would cut off your whole DNS!

FYI, the system's DNS is also set to Google's servers.

I tried commenting out `forward-zones-recurse`, but that made things worse. 
Loading pastebin.com and ycombinator.com failed with SERVFAIL.

I did manage to get the trace-regex for them though: 
http://pastebin.com/bvsRQc81

>>      • 2% cache hits
> 
> Bad, but not weird with all these random queries.

Umm... OK? Does PowerDNS 3.6RC1 handle mitigate these kinds of queries 
appropriately? I installed it recently as mentioned here: 
https://github.com/PowerDNS/pdns/issues/1453

I started seeing 30% throttled, and 7% cache hits (still bad?).

> Question: who is sending you these queries? Are you running an open recursor?

Yes, I am, and I was wondering if PowerDNS can do this responsibly (like 
blocking the random queries that I mentioned earlier. I also mentioned how that 
can be done and asked if PDNS 3.6 does it, or if it can be done via Lua).

- Greg

--
Please do not email me anything that you are not comfortable also sharing with 
the NSA.

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail

_______________________________________________
Pdns-users mailing list
[email protected]
http://mailman.powerdns.com/mailman/listinfo/pdns-users

Reply via email to