dns attack

We run MLS latest build on a FQDN with and ADSL line with PPOE.

The server is behind a AIRPORT EXTREME.

Since some days we encountered problems with our DNS. The computers seemed to be connected to the internet, however the sites would not open. We complained to our ISP which said that the line is ok.

After much sweat, fiddgeling around, rebooting I finally started reading the logs and activity monitor on the server. The only thing I thought strange was that named as a process sometimes used up to 30% processing power.

I switched of DNS, "for all clients" changed it to "this server only" and the named log started reading:

A/IN' denied

15-Aug-2013 14:29:50.248 client 186.2.166.81#30715: view com.apple.ServerAdmin.DNS.public: query (cache) 'hackwhatlol.cc/A/IN' denied

15-Aug-2013 14:29:50.255 client 186.2.166.81#34065: view com.apple.ServerAdmin.DNS.public: query (cache) 'hackwhatlol.cc/A/IN' denied

15-Aug-2013 14:29:50.263 client 186.2.166.81#35751: view com.apple.ServerAdmin.DNS.public: query (cache) 'hackwhatlol.cc/A/IN' denied

15-Aug-2013 14:29:50.264 client 186.2.166.81#15929: view com.apple.ServerAdmin.DNS.public: query (cache) 'hackwhatlol.cc/A/IN' denied

15-Aug-2013 14:29:50.264 client 186.2.166.81#40769: view com.apple.ServerAdmin.DNS.public: query (cache) 'hackwhatlol.cc/A/IN' denied

15-Aug-2013 14:29:50.264 client 186.2.166.81#15531: view com.apple.ServerAdmin.DNS.public: query (cache) 'hackwhatlol.cc/A/IN' denied

15-Aug-2013 14:29:50.277 client 186.2.166.81#39983: view com.apple.ServerAdmin.DNS.public: query (cache) 'hackwhatlol.cc/A/IN' denied

15-Aug-2013 14:29:50.277 client 186.2.166.81#47197: view com.apple.ServerAdmin.DNS.public: query (cache) 'hackwhatlol.cc/A/IN' denied

This means for me, that somebody at hackwhatlol.cc spent the time to send 100 queries/second to our server, which downed our "poor" server.

After I closed the DNS for external queries the malicious queries stopped after 5 minutes.

Is there anything else I can do?

Shall I close the port on the AEBS router for DNS too?

What a drag!. Can I somehow close this %&*ˆ$((* hackwhatlol.cc site down?

Help appreciated

Pierre