0

I'm running windows server 2012 and BIND. Recursion is set to deny.

I'm now receiving thousands of theses errors in the applications event viewer: client 174.0.60.249#45013 (stopdrugs77.com): query (cache) 'stopdrugs77.com/ANY/IN' denied

As soon as I block that IP, another starts the attack - is there a way to block the domain from querying the server ?

2 Answers 2

0

Welcome to the internet, you'll be constantly probed, investigated and attacked.

Your actual question makes no sense as domains don't query anything. So I'm guessing the real question is: how can I stop people from querying that domain on my server? Well, you can't really. Unless you want to block each and every IP that does this.

2
  • Hi - thanks. So what has stopdrugs77.com got to do with this ? This server has been running for 2+ years without too many issues. The log is now being filled with the above errors making it difficult to troubleshoot other issues - over 50 per second!
    – user200951
    Nov 29, 2013 at 9:48
  • 1
    Nothing except you spamming that domain here :) Nov 29, 2013 at 9:48
0

Do you have to allow querying from the Internet? If your Windows server has to server dns requests from specific IPs, then allow port 53 connection to those IPs only. Otherwise, outsiders will continuously try to use your server as an open/public dns server. If this query is coming from specific IPs or subnets, you can block those IPs, otherwise there isn't much you can do.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .