True, I was thinking of this earlier. When making changes you have to do it in 2 places, which is really the only downside, but it does protect you a bit. Of c

True, I was thinking of this earlier. When making changes you have to do it in 2 places, which is really the only downside, but it does protect you a bit. Of course, it's still not foolproof - when the first or second DNS server gets used is implementation dependent. We got bit by this, but not too badly - RAX filtered out some residential ISPs whose IPs were part of the DDoS attack but also sent legitimate queries so it was only some people who couldn't resolve. So I might still be too lazy to implement it for all our clients' zones. I'll have to read their post-mortem and see what steps they are taking to avoid this issue in the future.