# DNS DDoS via multiple exit relays causing performance issues?

**URL:** https://forum.torproject.org/t/dns-ddos-via-multiple-exit-relays-causing-performance-issues/8016
**Category:** Relay Operator
**Created:** [June 15, 2023, 10:38pm UTC](https://forum.torproject.org/t/dns-ddos-via-multiple-exit-relays-causing-performance-issues/8016 "2023-06-15T22:38:17Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![gus](https://forum.torproject.org/user_avatar/forum.torproject.org/gus/32/16_2.png) [@gus](https://forum.torproject.org/u/gus)
#### Post date: [June 15, 2023, 10:43pm UTC](https://forum.torproject.org/t/dns-ddos-via-multiple-exit-relays-causing-performance-issues/8016/2 "2023-06-15T22:43:33Z")

</div>

Hello, yes, some exit operators reported that issue last year.  
You may find this project by Artikel10 useful:

> **[GitHub - artikel10/surgeprotector: Block Tor Exit traffic to flooded IP...](https://github.com/artikel10/surgeprotector)**
>
> Block Tor Exit traffic to flooded IP addresses via ExitPolicy. - GitHub - artikel10/surgeprotector: Block Tor Exit traffic to flooded IP addresses via ExitPolicy.

From tor-relays mailing list:

> [@\[tor-relays\] Performance issues/DoS from outgoing Exit connections](https://forum.torproject.org/t/tor-relays-performance-issues-dos-from-outgoing-exit-connections/5262):
>
> Hello, on the evening of 2022-10-18, we (Artikel10) started getting alerts about our Tor servers, while our traffic declined sharply. When we investigated, we found that there were hundreds of thousands of TCP connections (per server) open to a single address, orders of magnitude more than any other address. We blocked this address via “ExitPolicy reject”, then another one, and since then things seem to have improved. I have thrown together a small Python script to detect this and generate “Ex…

---

_[View the full topic](https://forum.torproject.org/t/dns-ddos-via-multiple-exit-relays-causing-performance-issues/8016)._