Situation: Server (Win 2008R2) is being used in a DNS (amplification) DDoS attack. Amplification factor is already down to 1: Set the DNS server to non-recursive and removed all root hints -> DNS replies server failure for non-authoritative domains -> incoming DNS request size EQ outgoing DNS request size.
Still, even without amplification we are still unwillingly participating, if only as a simple deflector (since most likely the destination address has been spoofed to direct the DNS response traffic to the DDoS target).
Question: Is there and if yes, what is, the easiest way to prevent DNS responses for specific domain DNS requests? Reason behind that question is, that all those malicious DNS requests are for the same domain but from varying IPs. So IP blocking is not really that effective.
So how to filter out those DNS requests for specific domains and where (can the DNS server handle this or does that have to be done on the firewall?)?