I have a non domain joined authoritative dns server for a zone, I've disabled dns recursion in server settings. When i do a query with dig @ns1.mydomain.tld . it returns the root hints.
I've read that its possible to create a new primary zone named "." that will act as root zone. However this still returns the host name of my box and some incomplete soa information.
From my understanding returning root hints could be used for dns amplification attacks. Whats the best practice to handle this ?