What Is a DNS DDoS Attack?

What is a DNS DDoS attack?

A DNS DDoS attack is a distributed denial-of-service attack that targets the Domain Name System or uses it as a weapon. Either the flood hits DNS servers, so names stop resolving and your site looks down, or attackers bounce traffic off DNS servers to flood someone else. This entry is about understanding and defending. LoadFocus never simulates attacks.

Two forms of attack

• Direct flood on DNS servers. A botnet sends more queries than your authoritative name servers, or your provider's, can answer. Your web servers may be perfectly healthy, but visitors cannot find them. One variant asks for made-up names that no cache has seen, so the queries cannot be answered from a cache and every one reaches the authoritative server.
• Reflection and amplification. The attacker sends DNS queries to open servers with the victim's address forged as the source. The servers send their answers to the victim. Queries such as ANY return much larger responses than the request, which amplifies the traffic. CISA notes that because the responses come from valid servers, these attacks are extremely hard to prevent. See the DNS amplification attack entry.

Why DNS is a target

Almost every connection starts with a lookup, so taking DNS down takes everything behind it down too. Many DNS queries travel over UDP, which has no handshake, so a forged source address is not checked. Both facts are why the defences below focus on who may query, and where spoofed packets are dropped.

Warning signs

• Lookups fail or are slow while your servers are up.
• Your DNS servers see a surge of queries, or, for reflection, responses with no matching request. CISA names this as the main indicator.
• Checks from several regions fail to resolve your domain. Traffic monitoring on a firewall or intrusion detection system is the most reliable way to confirm an attack, per CISA's DoS guidance.

How to defend your DNS

• Turn recursion off on authoritative-only servers (CISA, RFC 5358).
• Serve recursive queries only to your own clients. RFC 5358 says nameservers should not offer recursive service to external networks by default. Use access control lists.
• Ask your ISP and network team about source address validation (BCP 38 ingress filtering), the real fix against spoofing according to RFC 5358 and CISA.
• Consider response rate limiting on authoritative servers. CISA warns it may block legitimate hosts.
• Use a managed DNS provider with DDoS protection and a plan for what you do when it is under attack. CISA recommends a DoS protection service and a recovery plan.
• Do not count on DNSSEC. RFC 4033 states that DNSSEC provides no protection against denial-of-service attacks, and its larger responses can make amplification easier.

For the wider picture see how to stop DDoS attacks, DoS protection and application-layer DDoS attacks, which hit the web app instead of DNS.

Where LoadFocus fits

LoadFocus does not load test DNS servers and does not simulate DNS or any other attack. Mitigating a DNS flood is the job of your DNS provider and network team. What LoadFocus can do is tell you when something is wrong and how your application copes with legitimate traffic. API monitoring includes DNS record checks and HTTP checks from 25 regions, with alerts by email, Slack and other channels, and free checks run every 5 minutes. Load testing sends HTTP and HTTPS requests to an application you own or are authorised to test, so you know its real capacity before an attack or a traffic spike.

FAQ: DNS DDoS attacks

How is a DNS DDoS attack different from DNS amplification?

DNS DDoS is the broad term. It covers direct floods against DNS servers and reflection attacks. Amplification is one reflection technique, where small queries trigger large responses sent to the victim.

Does DNSSEC stop DNS DDoS attacks?

No. RFC 4033 says DNSSEC provides no protection against denial-of-service attacks. It protects the integrity of DNS data, not its availability.

Will a CDN protect my DNS?

Not by itself. A CDN serves your content, but names still have to resolve through your DNS. Protect the DNS layer separately.

How can I tell it is DNS and not my website?

If your web servers respond when you reach them by IP address but the domain name fails to resolve from several places, DNS is the likely problem. Multi-region checks show this quickly.

Can I test my DNS with a flood?

Do not flood DNS servers you do not own, and do not do it to shared providers. Stress your own application with load tests in an agreed environment, and ask your DNS provider about their protection.