<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal>Hi everyone….<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>We just moved from BIND over to Unbound (for caching). One of the issues we were faced with on our BIND installations was substantial surges in fake domain name lookups. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>How does Unbound deal with these and is there any configuration items that we should be looking at to contain the effect they have. We had a customer recently on a 25X10 VDSL connection (yes, we’re an ISP) with some kind of a virus (or they were participating in a C&C botnet) – they launched about 200k lookups for random subdomains belonging to a valid .cn domain name. These lookups occurred over approximately 5 minute period.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I turned up logging to level “2” and also to level “3” and the amount of CPU/disk activity drove up drastically which I can understand. Is there a level that only logs “interesting” errors? I set it back to level 1 at this point to avoid expensive disk writes etc.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>DNSSEC – we have not enabled DNSSEC previously due to lack of understanding. As we are only using Unbound for caching purposes, is there a simple step by step I should be reading up on so we can enable it? My hope is that as more folks adopt DNSSEC in their authoritative servers that it cuts down on the “junk” we are seeing more frequently and of course provides secure validation on the actual lookups – is that a safe assumption?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Any suggestions, thoughs, input etc much appreciated – sorry for all the questions <span style='font-family:Wingdings'>J</span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Paul<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p></div></body></html>