I have a name server that's publicly accessible since it is the authoritative name server for a couple of domains.
Currently the server is flooded with faked type
ANY requests for isc.org, ripe.net and similar (that's a known distributed DoS attack).
The server runs BIND and has
allow-recursion set to my LAN so that these requests are rejected. In such cases the server responds just with
additional sections referring the root servers.
Can I configure BIND so that it completely ignores these requests, without sending a response at all?