<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div><br>
</div>
<div style="font-size:100%;color:#000000"><!-- originalMessage -->
<div><span style="font-size: 100%;">That is not off topic at all. You could use python plugins to facilitate this. The Unbound python plugin documentation/examples page has a blcklist DNS example. It could be modified to trigger blacklist entries on query metrics.
You can blacklist requesters through Unbound access control settings. You can blacklist domain responses by creating empty static domains. It seems you can mix the two with the new "views" feature.</span></div>
</div>
<div>
<div><br>
</div>
<div id="x_composer_signature">- Eric </div>
<div><br>
</div>
<div><br>
</div>
<div>-------- Original message --------</div>
<div>From: Aleš Rygl via Unbound-users <unbound-users@unbound.net> </div>
<div>Date: 9/1/17 06:51 (GMT-05:00) </div>
<div>To: unbound-users@unbound.net </div>
<div>Subject: Re: refuse ANY queries </div>
<div><br>
</div>
</div>
<font size="2"><span style="font-size:10pt">
<div class="PlainText">Hi,<br>
<br>
it is rather off-topic but it could help you: we use dnsdist DNS balancer to <br>
fight with various types of attacks including excessive amount of ANY queries. <br>
You can set up a rule counting queries per IP within a certain amount of time <br>
and react then. We have Unbound backends. 50kqps is a piece of cake.<br>
<br>
BR<br>
<br>
Aleš<br>
<br>
<br>
> BTW it is possible to play nasty tricks and reply with an 'actual' ANY:<br>
> <br>
> local-zone: "example.com." typetransparent<br>
> local-data: "example.com. TYPE255 \# 1 00"<br>
> <br>
> I hope such answer will break the botnet we are fighting against!<br>
> <br>
<br>
<br>
</div>
</span></font>
</body>
</html>