What is a DNS Amplification Attack? Defence Guide

What is a DNS amplification attack?

A DNS amplification attack is a reflection-based DDoS technique. The attacker sends small DNS queries to open DNS resolvers with the victim's IP address forged as the source. The resolvers send their much larger answers to the victim, so a modest amount of attacker bandwidth turns into a flood of unwanted traffic. It is a DDoS attack against network capacity, and the victim never talks to the attacker directly.

This entry is about understanding and defending against the technique. LoadFocus does not simulate DNS amplification or any other attack.

How it works

1. Spoofed query. The attacker sends a DNS query whose source address is the victim's IP. UDP has no handshake, so nothing checks that claim.
2. Large record requested. The query asks for something that produces a big answer, historically an ANY query or a record set with DNSSEC data.
3. Open resolver answers. A recursive resolver that accepts queries from anyone sends the full answer to the forged address.
4. Victim is flooded. Thousands of resolvers doing this at once saturate the victim's link, firewall or DNS servers. The size ratio between answer and query is the amplification factor, and it depends on the record data.

Example

A small company runs its own authoritative name server. An attacker spoofs the company's IP and queries thousands of misconfigured resolvers for large records. Traffic at the company's edge jumps from a few Mbit/s to saturating its uplink, the website and mail stop responding, and the traffic is hard to filter because it comes from legitimate resolvers. Rate-limiting at the ISP or a scrubbing service absorbs it.

Common mistakes that make it worse

• Leaving open recursion on. A resolver should answer recursive queries only for its own clients, not for the whole internet.
• Answering every ANY query in full. RFC 8482 lets authoritative servers return a small answer to ANY queries.
• No response rate limiting. Without it, one resolver can send the same large answer to a forged address again and again.
• Allowing spoofed traffic to leave your network. BCP 38 (RFC 2827) asks networks to drop outbound packets whose source address they do not own.
• Relying on bandwidth alone. Volumetric floods are absorbed upstream, at a CDN or scrubbing provider.

How to defend against it

• As a possible victim: put public services behind a CDN or DDoS protection provider and follow the steps in how to stop DDoS attacks.
• As a DNS operator: disable open recursion, enable response rate limiting in your DNS software, minimise ANY responses, and consider DNS Cookies (RFC 7873), which can greatly reduce what an off-path attacker can amplify.
• As a network operator: filter spoofed source addresses at the edge (BCP 38).

Related reflection attacks

For the broader category, see what is a DNS DDoS attack. The same pattern works with other UDP services. The largest known example is the Memcached attack on GitHub in February 2018, which peaked at 1.35 Tbps with an amplification factor of up to 51,000x, according to GitHub's incident report.

Detecting it with monitoring

An amplification flood shows up from outside as timeouts, failed checks and slow DNS answers. Continuous API and endpoint monitoring from multiple regions, with alerts on failure and recovery, tells you quickly that a service is unreachable and whether the problem is everywhere or in one region. The free plan checks every 5 minutes. Monitoring detects the impact; it does not stop the attack. Load testing is a separate capacity exercise and not a DDoS simulation: only test systems you own or are authorised to test, and coordinate with your provider first.

FAQ: DNS amplification attacks

Can I be the victim of a DNS amplification attack?

Yes. Anyone with a public IP address can be targeted, because the traffic is sent by third-party resolvers to a forged source address. A CDN or DDoS protection service is the usual defence.

How do I check whether my DNS server is an open resolver?

From a machine outside your network, send a recursive query to your server, for example with dig and the +recurse option. If it answers for domains it is not authoritative for, recursion is open and should be restricted to your own clients.

Does DNSSEC make amplification worse?

It can, because signed answers are larger. DNSSEC is still worth using for authenticity, but operators of DNS servers should combine it with response rate limiting.

Can BCP 38 stop DNS amplification?

If every network applied it, spoofed source addresses could not leave their origin and reflection attacks would largely end. Adoption is uneven, so victims and DNS operators still need their own defences.

What is the difference between a DNS amplification attack and a DNS DDoS attack?

DNS amplification is one reflection technique. A DNS DDoS attack is the broader category and also includes floods aimed at a DNS server itself. See the DNS DDoS attack entry for that wider view.