<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">On Jun 4, 2014, at 1:09 AM, Peter van Dijk <<a href="mailto:peter.van.dijk@netherlabs.nl">peter.van.dijk@netherlabs.nl</a>> wrote:<div><br><blockquote type="cite"><blockquote type="cite">I decided to pair up DNSChain with PowerDNS recursor thinking that maybe since it has been in development for a long time now that it more effectively deal with this problem, however, it seems that it's only marginally doing so.<br></blockquote><br>We understand from other communications that you are forwarding all queries to Google DNS. The mitigation in PowerDNS Recursor is based on noticing queries to remote servers are failing. If it was working in this case, it would cut off your whole DNS!</blockquote><div><br class="webkit-block-placeholder"></div><div>FYI, the system's DNS is also set to Google's servers.</div><div><br></div><div>I tried commenting out `forward-zones-recurse`, but that made things worse. Loading <a href="http://pastebin.com">pastebin.com</a> and <a href="http://ycombinator.com">ycombinator.com</a> failed with SERVFAIL.</div><br>I did manage to get the trace-regex for them though: <a href="http://pastebin.com/bvsRQc81">http://pastebin.com/bvsRQc81</a><div><br class="webkit-block-placeholder"></div><div><blockquote type="cite"><blockquote type="cite"><span class="Apple-tab-span" style="white-space: pre;"> </span>• 2% cache hits<br></blockquote><br>Bad, but not weird with all these random queries.</blockquote><br></div><div>Umm... OK? Does PowerDNS 3.6RC1 handle mitigate these kinds of queries appropriately? I installed it recently as mentioned here: <a href="https://github.com/PowerDNS/pdns/issues/1453">https://github.com/PowerDNS/pdns/issues/1453</a></div><div><br></div><div>I started seeing 30% throttled, and 7% cache hits (still bad?).</div><div><br class="webkit-block-placeholder"></div><div><blockquote type="cite">Question: who is sending you these queries? Are you running an open recursor?</blockquote><br></div><div>Yes, I am, and I was wondering if PowerDNS can do this responsibly (like blocking the random queries that I mentioned earlier. I also mentioned how that can be done and asked if PDNS 3.6 does it, or if it can be done via Lua).</div><div><br></div><div>- Greg</div><div>
<br class="Apple-interchange-newline"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">--</span><br style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">Please do not email me anything that you are not comfortable also sharing</span><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;"> with the NSA.</span>
</div>
<br></div></body></html>