Hardening advisory: tighten default RRL thresholds before you expose port 53

This is a hardening advisory, not a vulnerability disclosure — but it's important enough that we're putting it in the news feed rather than burying it in the docs.

The issue

BoronDNS ships with conservative RRL (Response Rate Limiting) defaults so that legitimate high-volume resolvers — large public DNS, corporate forwarders — don't get throttled out of the box:

[rrl]
responses_per_second = 25
window_seconds        = 5

On an open, internet-facing secondary, these defaults leave headroom that can be used to amplify reflection traffic before the limiter engages. They're fine behind a network ACL or for internal-only deployments. They are not what we'd recommend for a publicly reachable authoritative server.

What to change

For any secondary reachable from the open internet, we recommend:

[rrl]
responses_per_second = 5
window_seconds        = 2
slip                   = 2
exempt_prefixes        = ["YOUR_MONITORING_CIDR/24"]

See Security Hardening for the full checklist, including the matching firewall and exempt_prefixes guidance.

Will the defaults change?

We're evaluating tightening the shipped defaults in a future release. Until then, treat this as a required step in your rollout checklist, not an optional tuning knob.