BIND 9 denial of service being seen in the wild

Posted Nov 18, 2011 11:48 UTC (Fri) by terryburton (subscriber, #26261)
In reply to: BIND 9 denial of service being seen in the wild by brad@vaxxine.com
Parent article: BIND 9 denial of service being seen in the wild

"Only do that for local IP ranges! This eliminates all the resolver issues."

There may be many ways of coercing your local hosts to make lookups that you did not intend, such as including links in web content that the browser pre-caches as well as basic SMTP reception and mail content scanning. Enable query logging on your resolver to see the scope of this.