<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=windows-1256">
<META content="MSHTML 6.00.2800.1491" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>Hello List.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>We have one domain setup on our server dns but
there is no</FONT></DIV>
<DIV><FONT face=Arial size=2>website or email configured ..</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Recently we've noticed some increase
in server Bandwidth usage</FONT></DIV>
<DIV><FONT face=Arial size=2>and after using tcpdump, we were able to find the
problem which</FONT></DIV>
<DIV><FONT face=Arial size=2>is a DNS server on the Internet sending many
queries per second</FONT></DIV>
<DIV><FONT face=Arial size=2>to resolve MX , A records for that domain
which is not existing of</FONT></DIV>
<DIV><FONT face=Arial size=2>course but it keeps </FONT><FONT face=Arial
size=2>asking.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>One way was to block requests from that DNS IP but
that was not</FONT></DIV>
<DIV><FONT face=Arial size=2>practicle as many users on that DNS won't be able
to communicate</FONT></DIV>
<DIV><FONT face=Arial size=2>with our server.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>so What is the best way to prevent DNS queries
consuming bandwidth.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>tcpdump output extract:</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>14:40:09.407336 212.26.72.85.34997 >
ns.MyNameServer.net.domain: 51794 MX? MyDomain.com.
(29)(DF)<BR>14:40:09.411707 212.26.72.85.34997 >
ns.MyNameServer.net.domain: 14233 A? MyDomain.com. (29)
(DF)<BR>14:40:09.415880 212.26.72.85.34997 >
ns.MyNameServer.net.domain: 39317 MX? MyDomain.com. (29)
(DF)<BR>14:40:09.419827 212.26.72.85.34997 >
ns.MyNameServer.net.domain: 49503 A? MyDomain.com. (29)
(DF)<BR>14:40:09.423700 212.26.72.85.34997 >
ns.MyNameServer.net.domain: 29362 A? MyDomain.com. (29)
(DF)<BR>14:40:09.426963 212.26.72.85.34997 >
ns.MyNameServer.net.domain: 16692 A? MyDomain.com. (29)
(DF)<BR>14:40:09.430590 212.26.72.85.34997 >
ns.MyNameServer.net.domain: 65288 A? MyDomain.com. (29)
(DF)<BR>14:40:09.434350 212.26.72.85.34997 >
ns.MyNameServer.net.domain: 1341 A? MyDomain.com. (29)
(DF)<BR>14:40:09.438163 212.26.72.85.34997 >
ns.MyNameServer.net.domain: 57932 A? MyDomain.com. (29) (DF)</FONT></DIV>
<DIV><FONT face=Arial size=2>---</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>-aljuhani</FONT></DIV></BODY></HTML>