Please consider reconfiguring your resolver in one or more of these ways:
- To only serve your customers and not respond to outside IP addresses (in BIND, this is done by defining a limited set of hosts in "allow-query"; with a Windows DNS server, you would need to use firewall rules to block external access to UDP port 53)
- To only serve domains that it is authoritative for (in BIND, this is done by defining a limited set of hosts in "allow-query" for the server overall but setting "allow-query" to "any" for each zone)
- To rate-limit responses to individual source IP addresses (such as by using DNS Response Rate Limiting or iptables rules)
More information on this type of attack and what each party can do to mitigate it can be found here:
http://www.us-cert.gov/ncas/alerts/TA13-088A
If you are an ISP, please also look at your network configuration and make sure that you do not allow spoofed traffic (that pretends to be from external IP addresses) to leave the network. Hosts that allow spoofed traffic make possible this type of attack.
Example DNS responses from your resolver during this attack are given below.
Date/timestamps (far left) are UTC.
2016-01-12 14:45:26.273175 IP (tos 0x0, ttl 51, id 21217, offset 0, flags [+], proto UDP (17), length 1476) 200.152.69.87.53 > 66.150.155.x.4444: 15628| 22/0/0 cpsc.gov. RRSIG[|domain]
0x0000: 4500 05c4 52e1 2000 3311 234f c898 4557 E...R...3.#O..EW
0x0010: 4296 9b73 0035 115c 1007 2e6f 3d0c 8380 B..s.5.\...o=...
0x0020: 0001 0016 0000 0000 0463 7073 6303 676f .........cpsc.go
0x0030: 7600 00ff 0001 c00c 002e 0001 0000 4504 v.............E.
0x0040: 011c 0030 0702 0000 5460 569d a78b 5694 ...0....T`V...V.
0x0050: 5efb ^.
2016-01-12 14:45:26.283788 IP (tos 0x0, ttl 51, id 21220, offset 0, flags [+], proto UDP (17), length 1476) 200.152.69.87.53 > 66.150.155.x.4444: 15628| 22/0/0 cpsc.gov. RRSIG[|domain]
0x0000: 4500 05c4 52e4 2000 3311 234c c898 4557 E...R...3.#L..EW
0x0010: 4296 9b73 0035 115c 1007 ad62 3d0c 8380 B..s.5.\...b=...
0x0020: 0001 0016 0000 0000 0463 7073 6303 676f .........cpsc.go
0x0030: 7600 00ff 0001 c00c 002e 0001 0000 4504 v.............E.
0x0040: 011c 0001 0702 0000 5460 569d a78b 5694 ........T`V...V.
0x0050: 5efb ^.
2016-01-12 14:45:26.287165 IP (tos 0x0, ttl 51, id 21221, offset 0, flags [+], proto UDP (17), length 1476) 200.152.69.87.53 > 66.150.155.x.4444: 15628| 22/0/0 cpsc.gov. RRSIG[|domain]
0x0000: 4500 05c4 52e5 2000 3311 234b c898 4557 E...R...3.#K..EW
0x0010: 4296 9b73 0035 115c 1007 d7b3 3d0c 8380 B..s.5.\....=...
0x0020: 0001 0016 0000 0000 0463 7073 6303 676f .........cpsc.go
0x0030: 7600 00ff 0001 c00c 002e 0001 0000 4504 v.............E.
0x0040: 011c 0010 0702 0000 5460 569d a78b 5694 ........T`V...V.
0x0050: 5efb ^.
(The final octet of our customer's IP address is masked in the above output because some automatic parsers become confused when multiple IP addresses are included. The value of that octet is "115".)
-John
President
NFOservers.com