Advanced DNS Protection allows you to block or rate limit use of the ANY query in multiple ways.

1. By default rule 130400100 under DNS Amplification and Reflection will rate limit at 5 reflection/amplifcation queries per second.  Type ANY queries will trigger this rate limit.  This rule can be tuned more aggresively if needed.
2. Rule 130502800 under DNS Message types can be used to block Type ANY queries.
3. Type ANY queries can be blocked and rate limited by fqdn or overall using custom ADP rules as well.