@alex @eriner yeah unfortunately no default protection at the os level, and even big public dns providers (eg google, cloudflare) don't, think just because there's some niche legitimate use cases for it
when I said dns server I meant more a custom deployed one, eg the dns service in any standard router software will have an option for it, often default enabled
on the server system itself could just set up eg a local unbound service, that would protected against it