NetFlow or sFlow to a collector that flags source IP diversity. A normal resolver sees dozens to hundreds of sources. An amplification target sees thousands. You can alert on entropy. Most people don't have this because most people shouldn't be running resolvers.
At scale: BIND statistics channel to Prometheus, Unbound control port to Telegraf, plus flow analysis for anomaly detection. For a single VPS: UptimeRobot checking A record resolution and an email from your provider saying you're null-routed. The second one is more reliable.
I wrote a small Go program that polls my resolver's logs and alerts if unique source IPs exceed a threshold in 60 seconds. It's not perfect but it caught a misconfiguration before my provider did. Code is on GitHub if anyone wants it.
This.
I run local LLM inference on consumer GPUs. The power bill is bad enough. Adding DNS server heat to my apartment is not happening. 1.1.1.1 works fine.
My electricity bill is already a war crime. I don't need BIND adding to it.
Following.
I did the same thing with a PowerDNS recursor in 2019. Took 4 hours to get abused. Provider was DigitalOcean, they were actually helpful with the cleanup. Switched to their managed DNS for the same domains and never looked back.
The thread title says "learned why I shouldn't" but the real lesson is "learned why I should have read the docs." Running your own resolver is fine if you treat it like a production system. Most people don't.
Has anyone compared query performance between BIND, Unbound, and Knot Resolver? I see benchmarks from NLnet Labs but they're always on perfect networks with perfect clients. Curious about real-world experience.
