rec: Change spoof-nearmiss-max default to 1

[mnordhoff]

• Program: Recursor
• Issue type: Feature request

Short description

The spoof-nearmiss-max setting defaults to 20. In light of the SAD DNS attack bringing attention to this issue, it might be nice to change it to 1 (and perhaps even hardcode it in a later release).

I'm not sure if anyone remembers why 20 was chosen (in like 2006).

The question is if there are any downsides to changing it. Getting some large resolvers to experiment first might help answer that.

With the changes in #9744, I believe the design now matches Knot Resolver, which also uses 1 (and hardcodes it, I think).

From a coolness and marketing perspective, using Knot's analysis, using 1 totally mitigates the SAD DNS attack, while using 20 almost totally mitigates the attack, which doesn't sound as good.

Usecase

SAD DNS attack mitigation and consistency with Knot Resolver.