bind9 proper recursion setup
Filter who is able to query DNS recursively and who is not with ACLs.
acl my_net {
192.168.1.0/24;
};
acl my_other_net {
10.0.0.0/8;
};
options {
[ ... ]
recursion yes;
allow-recursion { my_net; };
blackhole { my_other_net; };
};
Also, set up ingress(BCP 84)/egress filtering in your gateway to avoid spoofed UDP packets to reach your network and generate unexpected traffic or poisoning. Blackhole untrusted parts of your local infrastructure.