Mitigate Mikrotik DNS Amplification Attack

I’m managing a /22 network that sits behind a Mikrotik 2116. Over the past few days we’ve been hit by a DNS amplification attack and the only clear symptom so far is unusual network slowdowns across the entire subnet. Standard rules haven’t been enough, so I need a specialist who can step in, trace the malicious traffic, and lock the door without interrupting legitimate DNS queries.

Here’s what I’m looking for:

• A quick remote audit of the current RouterOS configuration (WinBox or SSH access can be provided).
• Precise filter, mangle, and rate-limit rules—or an .rsc script—that cut the attack traffic while keeping normal resolution fast.
• A brief rollback plan and validation test so I can confirm the fix under load.

Although the hardware on site is the 2116, if your expertise comes from working with RB750, CCR1009, or RB3011 the concepts still translate, so don’t hesitate to respond. Please let me know your timeline and any access details you’ll need.