And on the blue team side of things, you can somewhat slow the attacker to a crawl for large data-sets with rate limits by tld, by domain, by source ip after a

And on the blue team side of things, you can somewhat slow the attacker to a crawl for large data-sets with rate limits by tld, by domain, by source ip after a bit of tuning. Some SIEM's will detect this, but it's usually too late by then. In Unbound DNS, some options you have are ratelimit, ratelimit-size, ratelimit-factor, ratelimit-below-domain (this can be a TLD), ip-ratelimit, ip-ratelimit-size, ip-ratelimit-factor. The IP rate limits are most useful for this. You should then have a monitoring tool watching Unbound query logs and alert when rate limits are being hit. Rate limits are only useful for slowing exfil of large data-sets. This will not help for blocking exfil of keys. If you are also running Unbound on all of your servers, the rates to your edge servers in your datacenter should give you a more realistic query rate to look for abusers, especially if Unbound on all of your servers has a reasonable cache-min-ttl set. This is just my personal preference, but I set log-queries: no and log-replies: yes as this provides more useful information to detect some anomalies.