What's interesting here is that the automatic cure (DDoS protection) was worse than the disease (even if there was an attack, blocking all access to the DNS servers is potentially worse than letting them get overloaded).

I wonder if it would be possible to express the idea that if a block being applied drops traffic well below expected levels, it must be a mistake?