The Art of Unspoofing - Describes several methods to track down denial of service attacks and includes a patch for Bind v8.3.3 and 4.9.9 which adds logging of external queries regarding domains the nameserver is authoritative for.
d4b82df78914aa7c41cf19cefad111b8b329311ecdc48509f3f748cee2d4f690