Recently we released PowerDNS Recursor 3.6.2 with a new feature that strictly limits the amount of work we’ll perform to resolve a single query. This feature was inspired by performance degradations noted when resolving domains hosted by ‘ezdns.it’, which can require thousands of queries to resolve.
During the 3.6.2 release process, we were contacted by a government security agency with news that they had found that all major caching nameservers, including PowerDNS, could be negatively impacted by specially configured, hard to resolve domain names. With their permission, we continued the 3.6.2 release process with the fix for the issue already in there.
We recommend that all users upgrade to 3.6.2 if at all possible. Alternatively, you can apply a minimal fix (including patches for older versions) to your own tree.
As for workarounds, only clients in allow-from are able to trigger the degraded service, so this should be limited to your userbase.