1

I have a custom DNS server and I noticed that the logs are getting filled with queries of type ANY for the . (single dot) domain, instead of www.example.com. or other domains which it could handle. It is not recursive and only handles very specific subdomains of the main domains, which are managed by commercial DNS hosting providers.

I don't respond at all to any query for domains which are not mine, because I want to avoid to be misused for DNS Amplification attacks. Please correct me if this is bad. Prior to this I was responding with dnslib.RCODE.REFUSED (code 5) response codes.

So I'm not really sure if these are some kind of attacks or a normal thing which happens. These are bursts of about 5-10 seconds in length with about 5-10 queries per second which happen a couple of times a minute.

Since I was storing these queries in a database I see that the IPs creating the most queries are very specific IPs from AT&T, then Comcast, although they could be spoofed.

What do I do with this? Ignore it because there is nothing I can do about it? It doesn't create any noticeable load on the server.

Improve this question
1
  • Welcome to the Internet, where scanning is omnipresent and misconfiguration is rampant. I'd simply ignore it, I have dedicated servers from cloud providers that are marked as authoritative for domains whose owner's IP I must have been given, I get scanned all day long, this is just what we've come to...
    – Ginnungagap
    Sep 7, 2019 at 8:13

1 Answer 1

Reset to default
2

You should ignore them, until they really start to disrupt your server/network because of their scale.

Otherwise you could put filters in place at the IP level for the IP sources or the specific DNS query you get, but this is hard to do properly, it is brittle due to the way DNS packets are built, and may have sideeffects to innocent bystanders.

So look instead at the rate-limiting (RRL) feature that exist in multiple nameservers, like bind.

Also note that ANY queries are now obsolete. Look at https://blog.cloudflare.com/deprecating-dns-any-meta-query-type/ for some introduction on this topic, and https://blog.cloudflare.com/what-happened-next-the-deprecation-of-any/

The IETF standard is now RFC 8482 "Providing Minimal-Sized Responses to DNS Queries That Have QTYPE=ANY"

Abstract

The Domain Name System (DNS) specifies a query type (QTYPE) "ANY". The operator of an authoritative DNS server might choose not to
respond to such queries for reasons of local policy, motivated by
security, performance, or other reasons.

The DNS specification does not include specific guidance for the
behavior of DNS servers or clients in this situation. This document
aims to provide such guidance.

This document updates RFCs 1034 and 1035.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .