From time to time the Plesk DNS server doesn't respond and websites are not available: query cache denied

Symptoms

• From time to time the DNS server doesn't respond and websites are not available

• An unusually high number of denied requests can be found in /var/log/messages log file:

  # egrep named.*denied$ /var/log/messages | wc -l
  2242638

  # egrep named.*denied$ /var/log/messages | tail -n1
  named[31354]: client @0x0000 203.0.113.2#18496 (example.com): query (cache) 'example.com/A/IN' denied

Cause

DNS server on Plesk is being under a DNS DDoS attack, all its resources are taken by a high number of denied requests and eventually has none left to serve legitimate requests causing websites to not open or fails to respond to global DNS servers.

Resolution

The functionality of internal DDoS protection is not yet implemented in Plesk. Please vote for this feature at the Plesk User Voice portal: DDoS Protection. The top-ranked suggestions are likely to be included on next versions of Plesk.

As a workaround:

• Contact a security or network expert to mitigate the DNS DDoS attack or consider managing the DNS externally using a service with DNS DDoS protection such as Cloudflare.