They'll quickly fix their error if you tell the world that these domain names don't exist.
The main thrust of
voretaq7's answer is something that you really should have done already, and probably have. If your DNS server is listening on an IP address that is reachable by the whole of Internet, then it shouldn't be providing proxy DNS service. You need to stop your server from wearing more than one hat, and make sure that it only provides content DNS service.
This leads to the meat of the answer. You simply need to configure your content DNS server to deny the existence of these domain names to the world. The people who've misconfigured their delegations to use your IP address(es) will soon realize their mistake, especially when the end users start complaining that mail, WWW, and other services yield errors about nonexistent domain names, and substitute the correct IP addresses. It's a very simple incentive to give: "Fix your delegations to not erroneously point the world to my servers, and your domain names will magically start existing."
How you do this is simplicity itself. You don't need to watch your logs, enumerate every new domain name as it comes along, and set up a zone covering it. Simply set up a
. zone. Your content DNS server will then deny the existence of every domain name that it is randomly queried for, where that domain name isn't covered by one of the zones that you actually intend to serve (and have arranged to be delegated to your server).
Remember to be nice when you do this. This error may well be the result of someone accidentally mistyping a couple of digits in a form. You don't want to annoy people. You only want to give them incentive to fix their error. So don't go setting the
MINIMUM field so high on your
SOA resource record for
. that the negative answers are cached by the world for a week. Enable the people concerned to get things changed quickly. A few hours is probably a good compromise between your need to reduce repeated queries and their need to be able to switch things over to the proper content DNS servers quickly. Don't go setting up wildcard
AAAA resource records that direct people to nasty places, either. Just return "no such name" answers.
An important note: Don't simply mirror public root DNS data.
You cannot just drop InterNIC's
root.zone file into your BIND setup. That database source file has delegations along the zone's bottom edge. Your DNS server will end up sending partial answers ending in delegations for all of these alien domain names that you are being queried about. That will just get it marked as "lame" (for returning upwards delegations) and resolving proxy DNS servers will end up querying it afresh quite often. It doesn't deny the existence of the domain names. You want your server to send complete answers ending in "no such name" for all of those alien domain names, denying their existence. Complete, negative, answers will be cached by the resolving proxies, and they won't come back asking afresh so often.
You therefore need a zone file for
. that does not have delegations along its bottom edge. Fortunately, that's actually a lot simpler than InterNIC's file, since for the bare minimum you only need three resource records, looking something akin to this:
@ 86400 IN SOA @ hostmaster 1 2D 1H 2W 3H
@ 86400 IN NS @
@ 86400 IN A 127.53.0.1
In djbdns format, this is a one-liner: