<div dir="ltr"><div>Hi Klaus!<br> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> In our case we are affected as we use Pdns + DB backend as backend.</blockquote><div><br></div><div>Yep, that's exactly our case as well - our legacy Pdns + mysql backends don't handle this very well. Longer term we intend to move away from that, but finding some improvements in the meantime for handling these floods would be helpful. I'll let you know if we come up with anything interesting!<br><br>-Dan</div><br clear="all"><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><table width="100%" style="font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:15px;line-height:22px"><tbody><tr><td width="55px" valign="top" style="padding-right:12px"><br><img src="https://digitaloceanspace.nyc3.digitaloceanspaces.com/do-sig_files/do-email_signature.png" style="width:50px"></td><td><div style="color:rgb(34,34,34);font-weight:bold;margin-top:4px"><br>Dan McCombs</div><div style="color:rgb(34,34,34);margin-bottom:12px">Senior Engineer I - DNS</div><div><a href="mailto:dmccombs@digitalocean.com" style="color:rgba(51,51,51,0.75);font-size:14px" target="_blank">dmccombs@digitalocean.com</a></div></td></tr></tbody></table></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Jan 8, 2024 at 8:31 AM Klaus Darilion <<a href="mailto:klaus.darilion@nic.at">klaus.darilion@nic.at</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg124617345919847636">
<div lang="DE" style="overflow-wrap: break-word;">
<div class="m_124617345919847636WordSection1">
<p class="MsoNormal"><span lang="DE-AT">Hi Dan!<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="DE-AT"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">This is a known issue and we have not found a simple solution in dnsdist. And obviously it is only a problem if the backend is slow. In our case we are affected as we use Pdns + DB backend
as backend.<u></u><u></u></span></p>
<ol style="margin-top:0cm" start="1" type="a">
<li class="m_124617345919847636MsoListParagraph" style="margin-left:0cm"><span lang="EN-US">Use a fast name server as additional backend (we used NSD) and dynamically provision targeted zones (and all subzones) on the
faster backend and redirect the zone to the fast backend (dnsdist rule). Out detection is based on “dsc” statistics collector.<u></u><u></u></span></li><li class="m_124617345919847636MsoListParagraph" style="margin-left:0cm"><span lang="EN-US">Use a fast nameserver instead of dnsdist + slow backend (we use Knot for customers that are constantly under attack)<u></u><u></u></span></li></ol>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">These two methods helped us, but of course add additional operations work to implement and operate it.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">If you find a simple dnsdist based solution to filter these random queries I would be interested too ;-)<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Regards<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">Klaus<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
<div style="border-top:none;border-right:none;border-bottom:none;border-left:1.5pt solid blue;padding:0cm 0cm 0cm 4pt">
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0cm 0cm">
<p class="MsoNormal"><b>Von:</b> dnsdist <<a href="mailto:dnsdist-bounces@mailman.powerdns.com" target="_blank">dnsdist-bounces@mailman.powerdns.com</a>> <b>
Im Auftrag von </b>Dan McCombs via dnsdist<br>
<b>Gesendet:</b> Freitag, 29. Dezember 2023 20:11<br>
<b>An:</b> <a href="mailto:dnsdist@mailman.powerdns.com" target="_blank">dnsdist@mailman.powerdns.com</a><br>
<b>Betreff:</b> [dnsdist] Suggestions for rules to block abusive traffic<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Hi all,<br>
<br>
I'm wondering if anyone has suggestions of reasonable ways to handle this type of abusive traffic with dnsdist.<br>
<br>
We've had on and off attacks recently targeting legitimate domains delegated to our authoritative service flooding queries for random subdomains of varying length and characters/words. i.e.
<a href="http://12345.example.com" target="_blank">12345.example.com</a>, <a href="http://fred.example.com" target="_blank">
fred.example.com</a>, <a href="http://abc178371jd.example.com" target="_blank">abc178371jd.example.com</a>, where
<a href="http://example.com" target="_blank">example.com</a> is a different domain we're authoritative for each attack.<br>
<br>
The dnsdist nodes can handle the traffic, but breaking cache and going through to our backends is having more of an impact.<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">We have thousands of domains, so it doesn't seem reasonable to apply individual rate limits to them all, but if there is a straight forward way to do something like that I'd be happy to hear it. The source addresses are well known public
resolvers that we shouldn't rate limit either.<br>
<br>
I'm wondering if there's any way to detect and apply a rule dynamically to respond to queries for one of these domains without affecting the source IP address entirely, and not require us to manually add a rule for each domain as it occurs.<br>
<br>
Any ideas would be appreciated.<br>
<br>
Take care,<br>
<br>
-Dan<br clear="all">
<u></u><u></u></p>
<div>
<div>
<div>
<table border="0" cellpadding="0" width="100%" style="width:100%">
<tbody>
<tr>
<td valign="top" style="padding:0.75pt 9pt 0.75pt 0.75pt">
<p class="MsoNormal" style="line-height:16.5pt"><span style="font-size:11.5pt;font-family:Helvetica,sans-serif"><br>
</span><span style="font-size:11.5pt;font-family:Helvetica,sans-serif"><img border="0" width="110" height="109" style="width: 1.1458in; height: 1.1354in;" id="m_124617345919847636_x0000_i1025" src="https://digitaloceanspace.nyc3.digitaloceanspaces.com/do-sig_files/do-email_signature.png"></span><span style="font-size:11.5pt;font-family:Helvetica,sans-serif"><u></u><u></u></span></p>
</td>
<td style="padding:0.75pt">
<div style="margin-top:3pt">
<p class="MsoNormal" style="line-height:16.5pt"><b><span style="font-size:11.5pt;font-family:Helvetica,sans-serif;color:rgb(34,34,34)"><br>
Dan McCombs<u></u><u></u></span></b></p>
</div>
<div style="margin-bottom:9pt">
<p class="MsoNormal" style="line-height:16.5pt"><span style="font-size:11.5pt;font-family:Helvetica,sans-serif;color:rgb(34,34,34)">Senior Engineer I - DNS<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal" style="line-height:16.5pt"><span style="font-size:11.5pt;font-family:Helvetica,sans-serif"><a href="mailto:dmccombs@digitalocean.com" target="_blank"><span style="font-size:10.5pt">dmccombs@digitalocean.com</span></a><u></u><u></u></span></p>
</div>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div></blockquote></div>