I run a game server that requires any IP to be able to use the DNS server I have set up. Similar to the Pokemon hacks out there. I don't want to turn recursion off, because I want people to continue using their game-console to go to any website. However, I have iptables rules set up that pretty much -j DROP anything that isn't query type "IN A" or "IN AAAA" So far, all the DDoS I've gotten in my logs involved an "IN ANY" request.