DNS RRL is dropping legitimate internal queries. How are you handling exceptions?

Question

DNS RRL is dropping legitimate internal queries. How are you handling exceptions?

Fedda306 Anadi 20

Hey all,

We enabled Response Rate Limiting (RRL) on our authoritative DNS servers to protect against amplification attacks, but now we're seeing legitimate queries from some internal subnets being dropped as well.

What's the best way to whitelist trusted subnets and tune the RRL response thresholds? Can this be configured cleanly through PowerShell or dnscmd without effectively disabling RRL?

Has anyone dealt with a similar setup?

0 comments

1 answer

Your answer

Answer 1

Hello,

Response Rate Limiting (RRL) in Windows DNS is effective against amplification attacks, but it can be overly aggressive if thresholds are not tuned or if trusted subnets are not excluded. By default, RRL applies uniformly to all clients, so legitimate internal queries can be dropped if they exceed the configured response rate.

The clean way to handle this is to configure RRL exclusions for trusted subnets and adjust the response thresholds. In Windows Server DNS, RRL parameters are exposed through registry keys and PowerShell. The key registry path is:

HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters

Here you can set values such as ResponseRateLimit, ResponseRateLimitInterval, and ResponseRateLimitExceptions. The ResponseRateLimitExceptions entry allows you to define CIDR ranges or specific IP subnets that should bypass RRL. For example, adding 10.0.0.0/8 or 192.168.100.0/24 ensures that internal clients in those ranges are not throttled.

If you prefer PowerShell, you can use Set-DnsServerResponseRateLimiting with the -Exceptions parameter to whitelist subnets. For instance:

powershell

Set-DnsServerResponseRateLimiting -Enabled $true -ResponsesPerSec 5 -Exceptions @("10.0.0.0/8","192.168.100.0/24")

This keeps RRL active for external queries but exempts your trusted internal ranges. You can also tune -ResponsesPerSec and -WindowInSec to raise the threshold so that legitimate bursts are not dropped.

Avoid disabling RRL entirely, because that negates the protection against amplification. The best practice is to whitelist trusted subnets and adjust thresholds conservatively until you find a balance between security and usability. After applying changes, monitor DNS logs (%systemroot%\system32\dns\dnsevent.log) to confirm that legitimate queries are no longer dropped while RRL continues to suppress abusive traffic.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

Domic Vo.