My server (Microsoft Server 2008 R2 x64) receives about an average of 20-30 ICS.org any requests (using forged source address) per second. Recursion is disabled and the answer only contains a list of root servers. Nevertheless i recently got a complaint about unrequested dns answers by my server. So my question is
What is the easist way to configure Microsoft DNS to not answer ISC.org ANY requests?
Since this is a development server (with a free academic license), i do not want to buy any software / solution.
This are the steps i took in consideration so far:
Configure Microsoft DNS to prevent from answering requests for domains that it is not authoritive for - This was my first thought, but i did not find any resources about that and i don't know if thats even possible.
Block IP after x udp requests / seconds on port 53 script / simple solution - did not found anything about that.
Using a free application level firewall for Windows Server 2008 R2 - as expected, didn't found any.
Using windows filtering platform for packet filtering. This was the last solution i came up with. If i understood it correctly, i would have to write a callout driver for "deep packet inspection" to find and drop ics.org any packets.
Since i have no previous knowledge in driver and wfp programming, i finally deciced to ask on SO before.