DNS Response Size Issues

// BIND DNS Response Size Controls - Comprehensive Amplification Protection
options {
    // ANY query restrictions - critical for preventing amplification attacks
    minimal-any yes;                    // Return minimal response for ANY queries (reduces response size)
    minimal-responses yes;              // Minimize all response sizes where possible (RFC compliant)
    // ANY queries can return 4KB+ responses, making them prime amplification targets
    
    // Response Rate Limiting (RRL) - primary defense against amplification attacks
    rate-limit {                        
        responses-per-second 10;        // Max responses per client IP per second (conservative)
        nxdomains-per-second 5;         // Limit NXDOMAIN responses (prevents enumeration attacks)
        errors-per-second 5;            // Limit error responses (SERVFAIL, REFUSED, etc.)
        all-per-second 20;              // Total response limit regardless of type (safety net)
        window 5;                       // Time window for rate calculations (5 second average)
        slip 2;                         // Send every 2nd response truncated (TC=1, forces TCP)
        log-only no;                    // Enforce limits (yes = testing mode, logs only)
        exempt-clients { localhost; 192.168.0.0/16; }; // Trusted networks exempt from RRL
        ipv4-prefix-length 24;          // Group IPv4 clients by /24 subnet (ISP level)
        ipv6-prefix-length 56;          // Group IPv6 clients by /56 delegation
        qps-scale 250;                  // Query-per-second scaling factor (higher = more burst tolerance)
    };
    
    // UDP packet size controls - prevent fragmentation and amplification
    max-udp-size 1220;                  // Max UDP response size (1220 = safe for most networks)
    edns-udp-size 1220;                 // EDNS0 UDP buffer size advertisement to clients
    max-cache-size 200m;                // Cache memory limit (prevent cache exhaustion attacks)
    clients-per-query 10;               // Max clients per identical query (duplicate query protection)
    max-clients-per-query 100;          // Absolute maximum clients for same query (DoS protection)
    
    // Advanced UDP and EDNS controls
    edns-udp-timeout 2000;              // EDNS UDP timeout in milliseconds (2 seconds)
    reserved-sockets 512;               // Reserve file descriptors for critical operations
    tcp-clients 100;                    // Maximum concurrent TCP connections
    tcp-idle-timeout 10;                // TCP connection idle timeout (10 seconds)
    
    // Additional anti-amplification measures
    recursion no;                       // Disable recursion on authoritative servers (critical!)
    additional-from-auth no;            // Don't add additional records from authoritative zones
    additional-from-cache no;           // Don't add additional records from cache
};

// Zone-specific controls for response size management
zone "example.com" IN {
    type master;                        // Primary authoritative zone type
    file "/etc/bind/zones/example.com.zone";        // Zone file path (absolute recommended)
    check-names fail;                   // Reject invalid hostnames (RFC 1123 compliance)
    notify explicit;                    // Only notify servers in also-notify list (security)
    allow-query { any; };               // Allow queries from any source (can restrict if needed)
    max-zone-ttl 86400;                 // Maximum TTL in zone (24 hours, prevents excessive caching)
    check-mx fail;                      // Validate MX records point to A/AAAA records
    check-spf warn;                     // Check SPF record syntax (log warnings)
    
    // Transfer controls to prevent zone data leakage
    allow-transfer { none; };           // Block zone transfers (AXFR/IXFR) from unauthorized hosts
    also-notify { };                    // Explicit notification list (empty = none)
};