For a while, I ran bind. Then for quite a while, I used a modified version of rbldnsd, which is not really meant to be used that way, but it was very good at a

For a while, I ran bind. Then for quite a while, I used a modified version of rbldnsd, which is not really meant to be used that way, but it was very good at absorbing abuse and didn't even implement most record types. It just had what I required. When I eventually needed a proper DNS servers again so that I could have CAA records, I switched to NSD [1]. NSD is stricly authoritative, vs. its counter-part Unbound [2] for recursive. It is a little faster than bind and has not had quite as many CVE's associated with it as bind. That said, bind was there for a long time and they learned along the way. You can find sites that compare the features and benefits of NSD vs. bind. I have not been used for amplification attacks. That said, people have tried enumerating many things over the years. There are some things you can do both in the DNS config and in iptables to reduce some noise. You would want to look on serverfault [3] for ideas. I set really high TTL records, so DDoS would only affect people that have not used my site in a while. [1] - NSD: https://www.nlnetlabs.nl/projects/nsd/about/ https://www.nlnetlabs.nl/projects/nsd/about/ [2] - Unbound: https://nlnetlabs.nl/projects/unbound/about/ https://nlnetlabs.nl/projects/unbound/about/ [3] - Serverfault: https://serverfault.com/ https://serverfault.com/