DNS Amplification attack?

Or better yet trace the query traffic back to the offending source
and implement BCP38 there. If the source won't implement BCP38
then de-peer them. It's time to take back the "commons".

Mark