# DNS NXDOMAIN Attack Aflex

**URL:** <https://community.a10networks.com/t/dns-nxdomain-attack-aflex/273>\
**Category:** aFleX\
**Tags:** dns, aflex, slb-adc, ddos-protection\
**Created:** [April 8, 2014, 4:09pm UTC](https://community.a10networks.com/t/dns-nxdomain-attack-aflex/273 "2014-04-08T16:09:41Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex002/uploads/a10_community/original/1X/bb9f186d33804d3044a0374e589f49fdf3be1328.png) [@system](https://community.a10networks.com/u/system)\
**Post date:** [April 8, 2014, 4:09pm UTC](https://community.a10networks.com/t/dns-nxdomain-attack-aflex/273/1 "2014-04-08T16:09:41Z")

</div>

All, this may be used as a template to protect against DNS NXDOMAIN attacks. The aFlex will dynamically build a table of FQDNs based on observed DNS replies that are ‘NXDOMAIN’. Entries are stored for an hour (3600 seconds). Subsequent requests for these FQDNs are blocked.

when RULE\_INIT {  
set ::holdtime 3600

```auto
\}
 
when DNS\_RESPONSE \{
set repcode [DNS::header rcode]
set name [DNS::question name] 
if \{$repcode equals "NXDOMAIN"\} \{
  if \{ [table lookup "blacklist" $name] == ""\} \{
    table add "blacklist" $name "blocked" $::holdtime

```

log local0.3 “Table entry created”  
&nbsp;&nbsp;return

```auto
  \}
  if \{ [table lookup "blacklist" $name] != ""\} \{
  log local0.3 "A subsequent response for $name was observed within the timeout"

```

return

```auto
  \}
\}
\}
 
when DNS\_REQUEST \{
set req [DNS::question name]
if \{ [table lookup "blacklist" $req] == ""\} \{
    log local0.3 "Request $req permitted."

```

return

```auto
  \}
  if \{ [table lookup "blacklist" $req] != ""\} \{
  log local0.3 "Request $req denied."

```

drop  
&nbsp;&nbsp;return

```auto
  \}
\}

```