Multi-query multiple DNS record types at once

NS Servers are not part of the SOA record. The SOA record and I quote from RFC 1035 (3.3.13):

Most of these fields are pertinent only for name server maintenance operations.

The fields in the SOA record are:

MNAME The of the name server that was the original or primary source of data for this zone.

RNAME A which specifies the mailbox of the person responsible for this zone.

SERIAL The unsigned 32 bit version number of the original copy of the zone. Zone transfers preserve this value. This value wraps and should be compared using sequence space arithmetic.

REFRESH A 32 bit time interval before the zone should be refreshed.

RETRY A 32 bit time interval that should elapse before a failed refresh should be retried.

EXPIRE A 32 bit time value that specifies the upper limit on the time interval that can elapse before the zone is no longer authoritative.

MINIMUM The unsigned 32 bit minimum TTL field that should be exported with any RR from this zone.

So with that out of the way, what is happening is this:

1. You dns server does not have the entry for bgsu.edu cached and is not authoritative, so it needs to ask the root hint servers where to go looking for the proper dns servers
2. The gTLD have GLUE records which are just the Name Servers for domains, this is the server you are going to actually query for the host you are trying to connect to.
3. You get bgsu.edu's Name servers
4. You do a DNS query for the host you are interested in
5. You get the DNS record you were originally looking for.

Allegedly, the reason you are asking is that you do not want to have DNS amplification attacks use your infrastructure.

An approach using netfilter/iptables has actually been discussed on different DNS-related mailing lists and newsgroups at the time of writing of the question. The consensus here is mainly that disabling certain query types altogether is not a good solution for DNS amplification attack prevention. It is usually sufficient to disable recursion for public clients which has been the default BIND configuration since BIND 9.4.1-P1.

If you can't disable recursion, one of the possible solutions presented by Stephane Bortzmeier is using a python script to construct netfilter rules which can subsequently be used for rate-limiting certain types of queries for specific DNS labels:

You can do it outside of the name server, also. For instance, on Linux, if the QNAME is fixed, let's say 'bad.example':

1) Get http://www.bortzmeyer.org/files/generate-netfilter-u32-dns-rule.py

2) Run it with the proper options:

rule=$(python generate-netfilter-u32-dns-rule.py --qname bad.example --qtype ANY) 

3) Use the output in a Netfilter rule:

iptables -A INPUT -p udp --dport 53 --match u32 --u32 "$rule" -j RATELIMITER 

4) Rate-limit:

iptables -A RATELIMITER -m hashlimit \ 
   --hashlimit-name DNS --hashlimit-above 20/second --hashlimit-mode srcip \ 
   --hashlimit-burst 100 --hashlimit-srcmask 28 -j DROP