@DomainBop - wow nice, I actually meant that most might think that using ISPConfig to manage the DNS cluster might be overkill.

most people except me (I have 9 DNS servers in 8 countries on 5 continents from 8 different providers) :P

I used ISPConfig to create a BIND DNS cluster, and it works great, but most here would consider that overkill.

What's the easiest way to make a non-cPanel 3-4 server DNS cluster?

@dominicl - You only need like 10GB/mo for DNS

Yes. Yes it will. Did I say otherwise? If you'd like to share your magical mystery search-all DNS configuration, go ahead. I'll stick with my method that finds 99% of installs.

That will find bind installations but it won't find other dns software that could also be configured to allow open recursion

No, just BIND or other name server recursion should be disabled, or enabled only for legitimate DNS clients subnet, or if legitimate clients cannot be well defined by address, then rate limit.

Bind RRL is the way to go, or similar with other DNS services

(Quote)

(Quote)

push "dhcp-option DNS 10.8.0.1"

You could pair dns-flood-detector with fail2ban to (temporarily) ban an IP address if it hits a certain threshold within a certain timeframe.

I am currently blocking port 53 on my VPSs. When I am ready, I would like to set up two of them to be primary and secondary (master and slave) DNS servers for my domains. Here is what I would like to

You have full control over your own dns-settings. Same reason why people want root-access.

(Quote)

What's the point of an authoritative DNS on a LEB?

Why reinvent the wheel? he.net, cloudflare anycast dns, linode dns, afraid.org

I AM implementing blocks on DNS for those PROVEN TO RUN A RECURSIVE DNS. They were warned, it's not my fault they ignored our message.

Run a script at the host-node level if you want to turn recursion off on every container, but don't block DNS ports inbound, that would be daft.