In working with Bind DNS servers, which are not open resolvers and do not perform recursive queries, I see a great mumber of incoming DNS query requests, that are denied or refused, that focus on domain names that list the DNS servers as being authoritative for the domains being queried, but are no longer configured with any zones for the domains. These domains are attributable to third parties who have moved their domains, and years later have never updated the listed DNS servers at their registrar. Why do these apparent DDoS UDP attacks focus on non-configured domains or zones? I haven't measured the network traffic to see if there is some type of amplification occurring, but there is a definite focus on non-configured zones.
We've seen similar questions from users who acquire IP space that were previously used for DNS servers. Suffice it to say that you don't even have to be listening on port 53, if your IP has ever held a DNS listener in the past (authoritative or recursive) you are going to be seeing stale queries for domains that your IP is not authoritative for.
Just ignore the stale traffic. If you need reassurance that you aren't being successfully leveraged in an attack, look at your ratio of sent to received traffic. If your average outbound traffic is more than double your input traffic, something is probably going on.