I am using PowerDNS Recursor in local ISP environment. Recursion is allowed only from our IP range but I've came with strange issue. Our own customers PC keeps attacking our DNS server with queries like:
15:43:38.473842 IP [CLIENT_IP].51097 > [DNSSERVER_IP].domain: 42318+ A? qhmrazabkvghwtgv.www.dl26.com. (47) 15:43:38.474161 IP [CLIENT_IP].40825 > [DNSSERVER_IP].domain: 14848+ A? yzqxqtklodgzuv.www.dl26.com. (45) 15:43:38.474443 IP [CLIENT_IP].34094 > [DNSSERVER_IP].domain: 35692+ A? inahybijsvqt.www.sf97.net. (43) 15:43:38.474953 IP [CLIENT_IP].39432 > [DNSSERVER_IP].domain: 7105+ A? kpkfgrsxihst.www.tpa.net.cn. (45)
Remote domain is almost always .cn one but the rest of domain name keeps changing. The easiest solution is to add hashlimit based rule on iptables but clients are behind NAT so traffic coming to DNS is marked with concentrator IP. I've tried also using spywaredomains zone but remote domain keeps changing so I cant really block it. The number of requests with SPAM domains cause PowerDNS Cache to overgrow and is also greatly increasing remote_timeout count. Is there any way to defend against such traffic and make DNS work like a charm again?