Reflection and amplification are different effects
Reflection redirects a server’s response toward a third party, commonly by forging the source address of a UDP request. Amplification increases the amount of traffic sent in response. Together, they can turn reachable DNS servers into participants in a distributed denial-of-service attack.
An open recursive resolver accepts recursive work from unintended clients. Restricting that service reduces opportunities for abuse. The IETF guidance in RFC 5358 recommends serving the intended client population and highlights network source-address filtering as a complementary defense.
Start with resolver access
Raven exposes DNS listeners on selected addresses and applies interface firewall policy and client ACLs. Those boundaries should agree with the intended client networks. A rate limit is not a substitute for closing unintended public recursion.
Review both UDP and TCP reachability and test authorized and unauthorized client paths. Consider the surrounding firewall and routing configuration as well as appliance settings. The final exposure boundary depends on the deployment, not simply on whether the appliance supports access controls.
How Raven constrains abusive work and responses
Admission controls limit accepted work globally, by transport, and by client. Bounded resolver budgets constrain the work performed while finding an answer. These controls address processing load, while response controls help limit the resolver’s role in sending abusive traffic.
- Response Rate Limiting (RRL) constrains similar UDP responses according to the active configuration.
- Minimal ANY responses reduce the response material supplied for ANY questions.
- DNS Cookies contribute to protocol-level abuse resistance.
- UDP/EDNS fitting bounds reply size and preserves whole RRsets, with TC signaling when a TCP retry is needed.
Validate availability without assuming a guarantee
A saturated network link can prevent legitimate traffic from reaching the resolver even when the resolver itself limits work. Coordinate upstream DDoS protection and source-address filtering with the network operator. DNSSEC authenticity checks do not replace these availability controls.
For acceptance, compare ordinary client success with behavior at configured limits. Check response codes, truncation and TCP retry behavior, query rates, and resource use. Overload may result in SERVFAIL, REFUSED, or DROP according to the selected control and settings; an unexpected failure needs investigation rather than an automatic attack label.