I recently discovered that my server was being used as part of a DNS DDOS. Basically, my BIND setup allowed recursion, and it was used to attack a certain IP address using IP spoofing.
I took the necessary measures to stop this, and disabled recursion. I'm no longer an amplifier, which I guess solves the large problem, but I'm still receiving the queries en mass, and BIND is replying with "denied" to all of them.
I'm just curious to know whether there's anything more I can do. I thought I might configure fail2ban to block them, doing something similar to the Debian recommendations, but according to other websites, and reasonable logic, this is not ideal, as an attacker could easily have me block any IP from accessing my server.
So what else can be done? Or should I just wait for the attackers to give up? Or hope they might rescan and delist me as an amplifier?