Rate limiting is relatively pointless. Attacks are just spread out over enough DNS servers so the rate limit isn't exceeded on any of them.

Even without rate limiting attackers will spread it out because too much traffic coming from one DNS server can be easily blocked at the network level.

You haven't convinced me that rate limiting is pointless.

It does nothing to stop real attacks.

DNS RRL is massively effective, what makes you think it isn't?

Many DDoS attacks will send a significant number of queries through any given DNS server to get a decent amplification. While normal clients will send 1 per TTL period. Yes, you can add servers at will, bit if everyone has RRL, your amplification factor is nearing zero.

No it's not. You're fundamentally misunderstanding amplification attacks if you think RRL brings down the amplification factor.

The amplification factor is the ratio of the response size to a single packet. Not the number of packets you can send to a server.

The only thing the RRL helps with is forcing the attacker to spread packets over more DNS servers, but, as I pointed out, a good amplification attack already does this because it makes it harder for the victim to block DNS servers by IP.

The attacker isn't going to run out of DNS servers because there are hundreds of thousands authoritative ones, let alone open resolvers.

The new middleware "firewall" in under development.