Recursive and authoritative DNS - DDOS attack

Question

We are using Windows Server DNS as our external DNS server which is available from internet and used to resolve our domain names. It is placed in DMZ. It is configured as recursive and authoritative. In internal company network we have
4 Windows DNS servers which have forwarders configured for this DNS server in DMZ. If some attacker from the internet will try to use our DNS server placed in DMZ and available from internet for a lot of recursive queries it could result in denial of service.
What is the best practice to avoid such attack?

Answer 1

Actually, there's a rather complex algorithm that's used that's similar to, if not the same as, what the client side resolver on any machine (Windows and non-Windows) uses. It's an industry standard based on RFC definitions.
More specifics in the following links, if you want to read up on it. And to one's surprise, it doesn't exactly work as one would like it to. The idea is to keep both up and the other one as a backup in case you fully lose the first one.
DNS Client side Resolver Service and DNS Forwarders Query Algorithm
http://blogs.msmvps.com/acefekay/2014/03/29/dns-client-side-resolver-service-and-dns-forwarders-query-algorithm/
This blog discusses:
WINS NetBIOS, Browser Service, Disabling NetBIOS, & Direct Hosted SMB (DirectSMB). Troubleshooting the browser service.
Client side resolution process chart.
The DNS Client Side Resolver algorithm.
If one DC or DNS goes down, does a client logon to another DC or use the other DNS server in the NIC?
DNS Forwarders Algorithm and multiple DNS addresses (if you've configured more than one forwarders or more than one IP in the NIC's DNS list)
Client side resolution process chart
http://blogs.msmvps.com/acefekay/2009/11/29/dns-wins-netbios-amp-the-client-side-resolver-browser-service-disabling-netbios-direct-hosted-smb-directsmb-if-one-dc-is-down-does-a-client-logon-to-another-dc-and-dns-forwarders-algorithm/
DNS Clients and Timeouts (Part 1 & Part 2), karammasri [MSFT] Dec 2011 6:18 AM
http://blogs.technet.com/b/stdqry/archive/2011/12/02/dns-clients-and-timeouts-part-1.aspx
http://blogs.technet.com/b/stdqry/archive/2011/12/15/dns-clients-and-timeouts-part-2.aspx
DOMAIN NAMES - CONCEPTS AND FACILITIES - Dicusses local resolvers.
http://tools.ietf.org/html/rfc882
==
To add on how the client resolver picks a nameserver, below is a link to a discussion that points out the following - and please note, the operative point in the first bullet point indicates "equivalent," meaning that all DNS servers you enter into
a NIC, must all reference the same exact data, so you can't mix nameserver with different data and expect the client to try all of them.
•by RFC, all nameservers in a zone's delegation are equivalent
•they are indistinguishable to the client
•clients are allowed to choose the NS to query with whichever policy they wish
•if any picked server fails to respond (e.g. "ns3"), then the next server is picked among the remaining set (e.g. ns1 and ns2) according to the policy
•often clients use sophisticated policies that "score" servers and pick more often the ones that replied faster
•as a by-product, in practice this policy makes caches favor "nearest" servers
Above list was quoted from:
When is a secondary nameserver hit?
http://serverfault.com/questions/130608/when-is-a-secondary-nameserver-hit
I hope that helps to understand it better.
Ace Fekay
MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
This posting is provided AS-IS with no warranties or guarantees and confers no rights.