A customer of mine is hosting public DNS cache servers. IP filtering is not an option, fail2ban would have to deal with daily abuses.