# Experimental fix for DNS DDOS attacks
**URL:** https://forum.torproject.org/t/experimental-fix-for-dns-ddos-attacks/8161
**Category:** Relay Operator
**Created:** [June 28, 2023, 12:20pm UTC](https://forum.torproject.org/t/experimental-fix-for-dns-ddos-attacks/8161 "2023-06-28T12:20:00Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@cozybeardev](https://forum.torproject.org/u/cozybeardev)
#### Post date: [June 28, 2023, 12:20pm UTC](https://forum.torproject.org/t/experimental-fix-for-dns-ddos-attacks/8161/1 "2023-06-28T12:20:00Z")
Hi,
As I can’t reply to the original thread here; [DNS DDoS via multiple exit relays causing performance issues? - #2 by gus](https://forum.torproject.org/t/dns-ddos-via-multiple-exit-relays-causing-performance-issues/8016/2) but I do wanted to share my quick-fix → I created this thread.
The issue is starting to get more frequent for me. So I currently have experimental restart cronjob of the unbound service on my relays. Unbound should never exceed even 10% sustained, but I’ve set it at 35% currently. If bad actors will abuse this to try to DOS me, I’ll migrate to another solution (e.g. [GitHub - artikel10/surgeprotector: Block Tor Exit traffic to flooded IP addresses via ExitPolicy.](https://github.com/artikel10/surgeprotector)) - but for now this seems fine. Either way, the attacks seem quite manual from what I can tell. When I remove the bad actor from my nodes, they start using other high bandwidth nodes of mine within 5 - 10 minutes sometimes. Some fun whack a mole. It’s also still sporadic, but frequency is increasing.
I documented it here; [add experimental automatic dns ddos mitigation · cozybear-dev/ansible-tor@80c732f · GitHub](https://github.com/cozybear-dev/ansible-tor/commit/80c732f9805339e2b870bb36351df9c853627d4c)
---
### Author:  [@everydayisoks](https://forum.torproject.org/u/everydayisoks)
#### Post date: [June 29, 2023, 5:05am UTC](https://forum.torproject.org/t/experimental-fix-for-dns-ddos-attacks/8161/2 "2023-06-29T05:05:23Z")
I was more curious about how the attack would implement a DNS-based DDoS attack. After understanding the process of the attack, we will try to examine the solution.