Infoblox’s global team of threat hunters uncovers a DNS operation with the ability to bypass traditional security measures and control the Great Firewall of China. Read about “Muddling Meerkat” and the many other threat actors discovered by Infoblox Threat Intel here.

Advanced DNS Protection

Reply

RFC 8482 implementation - minimizing Query Type ANY

New Member
Posts: 1
8417     0

Hello,

 

A new RFC (rfc 8482) tries to minimize the DDOS risk of the ANY query.

Is it currently possible to change the ANY query return value or block the query altogether? Or do we need to post a feature request with Infoblox.

 

Reference:

https://tools.ietf.org/html/rfc8482

https://blog.cloudflare.com/rfc8482-saying-goodbye-to-any/

 

Cesare

 

Re: RFC 8482 implementation - minimizing Query Type ANY

New Member
Posts: 5
8418     0

Advanced DNS Protection allows you to block or rate limit use of the ANY query in multiple ways.

 

  1. By default rule 130400100 under DNS Amplification and Reflection will rate limit at 5 reflection/amplifcation queries per second.  Type ANY queries will trigger this rate limit.  This rule can be tuned more aggresively if needed.
  2. Rule 130502800 under DNS Message types can be used to block Type ANY queries.
  3. Type ANY queries can be blocked and rate limited by fqdn or overall using custom ADP rules as well.

 

Re: RFC 8482 implementation - minimizing Query Type ANY

New Member
Posts: 1
8418     0

so there is no other way then buying a new license for ADP to block Any queries ?

Showing results for 
Search instead for 
Did you mean: 

Recommended for You