DDOS port 53 problem

[wprescott]

Received notification that our server is taking part in an attack. Their logs shows:

IP x.x.x.x.53 > y.y.y.y.25448: 7490 Refused- 0/0/1 (36)

x.x.x.x is our Ip and y.y.y.y is the remote machine

I have followed lots of links and advice. I have turned off DNS recursion etc.

Plesk 11 Windows 2008 anybody come across this problem and solved?

Help appreciated.

 

[Sad]

What kind of attack they are talking about? Do they have a request content from your DNS server?

 

[wprescott]

Looks like typical DDOS DNS amplification via port 53

 

[wprescott]

Sorry - shameless bump I need help on this as still happening. I need to lock it down but the system still has to work of course.

I've looked at the null route method at http://www.beaming.biz/RTFM/index.php/how-to-add-a-null-route-in-windows/ but I would need to automate that.

Thanks in advance!