A method for installing and running an applianced domain name server, the method comprising: forming a software installation package for the domain name server, the software installation package comprising: - a hardened operating system; - a securely pre-configured domain name server software; - a management interface; - a local attack detection logic ("ADS") for detecting an attack attempt, wherein the attack detection logic comprises means for analyzing (2-1... 2-3) a plurality of IP packets based on a predetermined set of attack detection rules and means for monitoring a frequency of inquiries from each of a plurality of client computers, the frequency of inquiries being determined by keeping track of the number of inquiries from each client computer per unit of time, an attack attempt being detected by the local attack detection logic if the number of inquiries from any client computer per unit of time exceeds a predetermined threshold and if the size of inquiries exceeds a typical inquiry size by significant predetermined margin; - a local response logic for responding to a detected attack attempt; installing the software installation package in a domain name server; detecting, using the local attack detection logic installed to the domain name server, an attack attempt to the domain name server from a client computer based on the predetermined set of attack detection rules; and responding, using the local response logic installed to the domain name server, to the detected attack attempt by creating for a firewall protecting the domain name server a local firewall rule which blocks traffic from the client computer to the domain name server. forming a software installation package for the domain name server, the software installation package comprising: - a hardened operating system; - a securely pre-configured domain name server software; - a management interface; - a local attack detection logic ("ADS") for detecting an attack attempt, wherein the attack detection logic comprises means for analyzing (2-1... 2-3) a plurality of IP packets based on a predetermined set of attack detection rules and means for monitoring a frequency of inquiries from each of a plurality of client computers, the frequency of inquiries being determined by keeping track of the number of inquiries from each client computer per unit of time, an attack attempt being detected by the local attack detection logic if the number of inquiries from any client computer per unit of time exceeds a predetermined threshold and if the size of inquiries exceeds a typical inquiry size by significant predetermined margin; - a local response logic for responding to a detected attack attempt; - a hardened operating system; - a securely pre-configured domain name server software; - a management interface; - a local attack detection logic ("ADS") for detecting an attack attempt, wherein the attack detection logic comprises means for analyzing (2-1... 2-3) a plurality of IP packets based on a predetermined set of attack detection rules and means for monitoring a frequency of inquiries from each of a plurality of client computers, the frequency of inquiries being determined by keeping track of the number of inquiries from each client computer per unit of time, an attack attempt being detected by the local attack detection logic if the number of inquiries from any client computer per unit of time exceeds a predetermined threshold and if the size of inquiries exceeds a typical inquiry size by significant predetermined margin; - a local response logic for responding to a detected attack attempt; installing the software installation package in a domain name server; detecting, using the local attack detection logic installed to the domain name server, an attack attempt to the domain name server from a client computer based on the predetermined set of attack detection rules; and responding, using the local response logic installed to the domain name server, to the detected attack attempt by creating for a firewall protecting the domain name server a local firewall rule which blocks traffic from the client computer to the domain name server.