Disabling recursion responses on public DNS servers to random internet IPs - ie closing the "open resolver" hole - does NOT mitigate this because you can still do a spoofed DNS reflector/amplification attack simply by sending queries that result in a "can't give you an answer" response, which can still be much larger than the incoming query.
Really need to use some combination of response-rate limiting or upstream measures as mentioned here previously. Technically you could use egress-filtering to block outgoing packets that originated on a different link/interface than the route to the spoofed destination, but on simple networks (ie with a single internet link) that's not feasible.
Here's an old whitepaper that discusses some other mitigation measures, like using packet hop-counts to guess about the legitimacy of an incoming packet:
But of course filtering and rate-limiting responses at the "reflector point" still doesn't mitigate the large incoming packet-stream that is being directed at your DNS server. It does spare the intended target from being DDoS'd by your DNS server and your DNS server from being bogged-down with junk traffic.