<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
The OP mentioned <br>
<br>
<blockquote type="cite">the cache started to store totally useless <b>records</b>
of type TXT and <b>NULL</b>.</blockquote>
<br>
Whilst TXT records could serve a legitimate purpose, e.g.
SFP/DKIM/DMARC, there appears not legitimate purpose at all for NULL
records, according to
<a class="moz-txt-link-freetext" href="https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml">https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml</a>
and subsequent <a class="moz-txt-link-freetext" href="https://tools.ietf.org/html/rfc1035">https://tools.ietf.org/html/rfc1035</a>.<br>
<br>
Thus I would reckon the OP has a valid point of questioning<b> NULL
records</b> being cached by unbound, or even served to querying
clients at all. There seems to be no mechanism however in unbound to
prevent such.<br>
<br>
I might be mistaken but the QTYPE=NULL Key Tag query pertaining to
DNSSEC as in <a class="moz-txt-link-freetext"
href="https://tools.ietf.org/html/rfc8145#section-5.1">https://tools.ietf.org/html/rfc8145#section-5.1</a>
does not query an actual <b>NULL record </b>but rather specifies <br>
<br>
<blockquote type="cite">
<pre class="newpage">Anything at all may be in the RDATA field so long as it is 65535 octets or less.</pre>
</blockquote>
<br>
<div class="moz-cite-prefix">On 22.11.2018 15:12, I via
Unbound-users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAO-L_V891p2o9Ds8CR9BxmbjkcJTnMkx0J0Xe4NfxW1eOQVMqA@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="auto">
<div dir="auto">Hi,<br>
</div>
<div dir="auto"><br>
</div>
<div dir="auto">Rate-limiting queries per source IP with
specific query type (NULL/TXT) and long qname (e.g. 20 byte or
longer). That should be possible using iptables hashlimit
module and dns-extension [1].</div>
<div dir="auto">That will make DNS-tunnel VPN useless while
accepting legitimate TXT/NULL queries.</div>
</div>
<div dir="auto"><br>
</div>
<div dir="auto">[1] <a
href="https://github.com/mimuret/iptables-ext-dns"
target="_blank" moz-do-not-send="true">https://github.com/mimuret/iptables-ext-dns</a></div>
<div dir="auto"><br>
</div>
</blockquote>
<br>
</body>
</html>