Have BIND9 drop non-authorative queries

Question

My ISP allows me to run a DNS server, as long as it won't respond to non-authorative queries. This means no response whatsoever. I had it configured such as to refuse non-authorative, like this;

> tweakers.net
Server:     my.server.net
Address:    my.ip#53

** server can't find tweakers.net: REFUSED

But apparently that's not good enough anymore. It needs to simple not send a response at all. Is that even possible?

This is my current options file;

options {
    directory "/var/cache/bind";

    recursion yes;

    allow-recursion { internal; };

    allow-transfer { *secondary dns ip*; };

    dnssec-enable yes;
    dnssec-validation yes;

    auth-nxdomain no;    # conform to RFC1035

    filter-aaaa-on-v4 yes;

};

My internal ACL

acl internal {
    192.168.40.0/24;
    127.0.0.1;
    10.0.3.1/24;
    };

Maybe I am not googling the right things, but I can't find such an option.

Answer 1

You need to disable Recursion.

This will stop it from responding to queries for non-authoritative zones.

But it will still respond with a SERVFAIL.

Answer 2

Found a iptables solution here. Similar question posted on Serverfault. https://serverfault.com/questions/438515/bind-blackhole-for-invalid-recursive-queries

There isn't a way to do this with Bind. However you can use iptables firewall rules to block responses to all recursive queries.

Answer 3

Like with you, I dislike when my server involved in DDOS, even it responds with small 30-byte packets. Also, for some reasons I unable to use iptables to block spoofed requests. Server vulnerability was fixed 3 months ago, but botnet still send spoofed requests to server.

So, as result, you can use this simple patch to not send REFUSED response (requests will be dropped):

--- bind9-9.9.5.dfsg/bin/named/query.c.orig        Thu Aug  6 21:56:57 2020
+++ bind9-9.9.5.dfsg/bin/named/query.c     Thu Aug  6 22:08:15 2020
@@ -1038,7 +1038,7 @@
                                         sizeof(msg));
                        ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
                                      NS_LOGMODULE_QUERY, ISC_LOG_INFO,
-                                     "%s denied", msg);
+                                     "%s dropped", msg);
                }
                /*
                 * We've now evaluated the view's query ACL, and
@@ -5809,8 +5809,9 @@
                        } else
                                inc_stats(client, dns_nsstatscounter_authrej);
                        if (!PARTIALANSWER(client))
-                               QUERY_ERROR(DNS_R_REFUSED);
-               } else
+               //              QUERY_ERROR(DNS_R_REFUSED);
+                               QUERY_ERROR(DNS_R_DROP);
+               } else
                        QUERY_ERROR(DNS_R_SERVFAIL);
                goto cleanup;
        }
# diff -u query.c.orig query.c

... as result, you get nice logs which like this one:

Aug  6 21:39:29 topor named[2652]: client 78.180.51.241#43072 (.): query (cache) './ANY/IN' dropped
Aug  6 21:40:00 topor last message repeated 485 times

And there will be no 'REFUSED' reply if query came from unauthorized network / for unsupported domain.