Seems there must be some secret sauce to running an open recursive DNS server that avoids amplification attacks.

Wonder how much is technical/operational and how much is social? (ie, 8.8.8.8 is a well-known DNS server run by a big company, so we won't ban it for being a scary open resolver)

I seem to remember reading something about Network Manager planning to get the ability to set up its own local recursive name server when on a network without a good one.