How to protect bind from outgoing DDoS?

Question

Domain Name System

I remember a series of articles on Habré about a vulnerability in the bind DNS server, the essence of which is that an attacker sends thousands of requests to my bind substituting the victim's IP into the source address, and my DNS server, like thousands of those, sends responses to the victim's IP, organizing this DDoS attack.
Please tell me how to protect your bind from this, I can not find information about this.

Answer 1

The attack is called DNS amplification, bind uses RRL to prevent it
https://kb.isc.org/article/AA-00994/0