On Jun 4, 2014, at 1:09 AM, Peter van Dijk <[email protected]> wrote:
>> I decided to pair up DNSChain with PowerDNS recursor thinking that maybe >> since it has been in development for a long time now that it more >> effectively deal with this problem, however, it seems that it's only >> marginally doing so. > > We understand from other communications that you are forwarding all queries > to Google DNS. The mitigation in PowerDNS Recursor is based on noticing > queries to remote servers are failing. If it was working in this case, it > would cut off your whole DNS! FYI, the system's DNS is also set to Google's servers. I tried commenting out `forward-zones-recurse`, but that made things worse. Loading pastebin.com and ycombinator.com failed with SERVFAIL. I did manage to get the trace-regex for them though: http://pastebin.com/bvsRQc81 >> • 2% cache hits > > Bad, but not weird with all these random queries. Umm... OK? Does PowerDNS 3.6RC1 handle mitigate these kinds of queries appropriately? I installed it recently as mentioned here: https://github.com/PowerDNS/pdns/issues/1453 I started seeing 30% throttled, and 7% cache hits (still bad?). > Question: who is sending you these queries? Are you running an open recursor? Yes, I am, and I was wondering if PowerDNS can do this responsibly (like blocking the random queries that I mentioned earlier. I also mentioned how that can be done and asked if PDNS 3.6 does it, or if it can be done via Lua). - Greg -- Please do not email me anything that you are not comfortable also sharing with the NSA.
signature.asc
Description: Message signed with OpenPGP using GPGMail
_______________________________________________ Pdns-users mailing list [email protected] http://mailman.powerdns.com/mailman/listinfo/pdns-users
