Anomaly Protection
Navigation: DNS Security → Anomaly Protection
Anomaly protection stops abuse of DNS as a transport or amplifier, not just bad domain names. It rate-limits clients, drops malformed packets, and contains NXDOMAIN and query floods so the local DNS server and WAN uplink stay available.
Protections
| Protection | What it stops |
|---|---|
| Rate limiting | One host or subnet flooding queries |
| Amplification protection | Large ANY/TXT-style responses used to reflect traffic |
| Malformed DNS detection | Truncated, illegal, or non-DNS payloads on port 53 |
| Excessive NXDOMAIN | Scanning, DGA attempts, and misconfigured clients |
| Query floods | Sudden spikes that would saturate AD DNS / BIND or the WAN |
These checks run early in the pipeline (see Architecture) so obviously abusive traffic never reaches threat intel or recursion.
Typical log
{
"src_ip": "192.168.1.40",
"domain": "*",
"qtype": "ANY",
"dnssec": "unsigned",
"category": "unknown",
"reputation": "suspicious",
"action": "block",
"reason": "Query flood / rate limit"
}
Recommended limits
| Control | Starting point | Tune when |
|---|---|---|
| Queries per client / second | Modest cap for workstations; higher for the AD DNS forwarder IP | False drops during software update bursts |
| NXDOMAIN per client / minute | Tight on user VLANs | Legitimate bulk lookups (mail scanners) |
| ANY / unusual qtypes | Restrict from LAN clients | Keep allowed from the local DNS server if it must query ANY |
| Malformed packets | Always drop + log | No exception |
| Response size / amplification | Cap or drop oversized answers to the internet | Authoritative hosting on TOORCE (uncommon) |
If AD DNS / BIND is the only host that recurses through TOORCE, apply higher limits to that server IP and stricter limits to end-user subnets.
Inbound vs outbound
| Direction | Focus |
|---|---|
| LAN → TOORCE / internet | Client floods, NXDOMAIN, tunneling-like volume |
| Internet → LAN | Amplification and malformed packets if you publish DNS |
Most TOORCE deployments only recurse out. Still enable inbound protections on WAN so unused DNS listeners are not used as reflectors.