[Pdns-users] DDoS attack with random A requests causes SQL backend overload

[David Porter]

Hello,

We have received a DDoS attack on our powerdns infrastructure.
The DNS requests were all non-existing records in 1 single zone.

Eg:
  ghz2.mydomain.com
  cdzx.mydomain.ocom
  hh3r.mydomain.com

The result was that the SQL backend was overloaded with these queries and caused some of our servers not to respond to legitimate queries.
See here an example from the SQL log:

2021-07-13T14:50:43.459635Z      3061 Reset stmt
2021-07-13T14:50:43.463172Z      3059 Execute   SELECT content,ttl,prio,type,domain_id,disabled,name,auth FROM records WHERE disabled=0 and name='gzh1.mydomain.com' and domain_id=1280
2021-07-13T14:50:43.463989Z      3059 Reset stmt
2021-07-13T14:50:43.468001Z      3060 Execute   SELECT content,ttl,prio,type,domain_id,disabled,name,auth FROM records WHERE disabled=0 and name='cdzx.mydomain.com' and domain_id=1280
2021-07-13T14:50:43.468822Z      3060 Reset stmt
2021-07-13T14:50:43.471102Z      3061 Execute   SELECT content,ttl,prio,type,domain_id,disabled,name,auth FROM records WHERE disabled=0 and name='cvqi.mydomain.com' and domain_id=1280
2021-07-13T14:50:43.472178Z      3061 Reset stmt
2021-07-13T14:50:43.474985Z      3059 Execute   SELECT content,ttl,prio,type,domain_id,disabled,name,auth FROM records WHERE disabled=0 and name='hh3r.mydomain.com' and domain_id=1280
2021-07-13T14:50:43.475371Z      3059 Reset stmt
2021-07-13T14:50:43.478971Z      3060 Execute   SELECT content,ttl,prio,type,domain_id,disabled,name,auth FROM records WHERE disabled=0 and name='9jv9.mydomain.com' and domain_id=1280
2021-07-13T14:50:43.479399Z      3060 Reset stmt
2021-07-13T14:50:43.483063Z      3061 Execute   SELECT content,ttl,prio,type,domain_id,disabled,name,auth FROM records WHERE disabled=0 and name='boxl.mydomain.com' and domain_id=1280
2021-07-13T14:50:43.483457Z      3061 Reset stmt

The new zone cache feature is only caching the "domains" table, it's not caching the each record in the backend.

Is there any way how we can ensure that powerdns is caching a complete zone in case we are encountering a random generated dns attack on our authorative DNS servers?

Thank you,

David
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.powerdns.com/pipermail/pdns-users/attachments/20210716/c4386012/attachment.htm>