DNS Amplification (DDoS)
A reflection/amplification attack that weaponizes open DNS resolvers — turning small spoofed queries into massive floods of traffic aimed at victims.
Reflection + Amplification
DNS amplification is a two-part attack. Reflection means the attacker uses a third party (the resolver) to send traffic to the victim — keeping the attacker's identity hidden and distributing attack load. Amplification means the response is much larger than the query, multiplying the attacker's bandwidth many times over.
The attacker sends a small DNS query (typically 40–60 bytes) with a spoofed source IP (the victim's address) to an open DNS resolver. The resolver sends the full response — which can be 3,000+ bytes for an ANY query — to the victim. With thousands of open resolvers and a botnet of spoofing sources, attackers can generate hundreds of Gbps of traffic.
DNS amplification peaked as the dominant DDoS vector in 2013–2016, generating attacks exceeding 400 Gbps. The 2013 Spamhaus attack (300 Gbps) briefly disrupted large portions of the internet and made global headlines.
How a DNS Amplification Attack Unfolds
Attacker identifies open resolvers
The attacker scans the internet for DNS resolvers that answer queries from any source IP (open resolvers). Tools like Masscan or Shodan can enumerate millions in hours.
Craft high-amplification query
The attacker crafts a query type with a high amplification ratio. DNS ANY queries or queries for DNSSEC-signed zones (which include large RRSIG records) can produce responses 50–100× the query size.
Spoof victim's IP as source
Each query is sent with the victim's IP as the source address. UDP has no connection state — resolvers accept and respond to any source IP without verification.
Resolvers flood the victim
Thousands of open resolvers each send their amplified response to the victim. 10,000 resolvers × 3 KB response = 30 MB per query wave. At 1,000 queries/second per resolver: massive traffic flood.
Victim's bandwidth/infrastructure overwhelmed
The victim's upstream link saturates. Web servers become unreachable. Even scrubbing services and anycast providers can be overwhelmed at sufficient scale.
Amplification Factors by Query Type
Not all queries amplify equally — attackers choose query types that maximize damage
| Query Type | Query Size | Response Size | Amplification | Notes |
|---|---|---|---|---|
| ANY | ~60B | ~3,000B | ~50× | Returns all records; RFC 8482 now restricts ANY responses |
| DNSKEY | ~50B | ~1,700B | ~34× | Returns DNSSEC public keys; large for RSA-signed zones |
| TXT (SPF) | ~55B | ~450B | ~8× | SPF records with many includes produce large responses |
| A (DNSSEC) | ~55B | ~600B | ~11× | A record + RRSIG + NSEC adds significant overhead |
| NS | ~45B | ~350B | ~8× | Domains with many NS records and glue amplify more |
Defending Against Amplification Attacks
The most important mitigation. Configure your recursive resolvers to only answer queries from authorized networks (your own IPs, customers). Use access control lists (ACLs) in BIND, Unbound, or PowerDNS. An open resolver that answers anyone is a DDoS weapon waiting to be used.
RRL limits how many identical (or near-identical) responses a nameserver sends per second to a given IP. Implemented in BIND (rate-limit), Unbound, and NSD. Reduces amplification without blocking legitimate traffic. RFC 8020 provides guidance.
BCP38/RFC 2827 recommends that ISPs filter outbound packets with spoofed source IPs. If every ISP implemented this, IP spoofing would be impossible, eliminating reflection attacks entirely. The MANRS initiative tracks ISP adoption.
Authoritative nameservers using anycast distribute attack traffic across hundreds of nodes globally — no single node is overwhelmed. Pair with upstream DDoS scrubbing services (Cloudflare Magic Transit, Akamai Prolexic) that absorb and filter attack traffic before it reaches your infrastructure.
dig +short test.openresolver.com TXT @YOUR-RESOLVER-IPIf it returns "open-resolver-detected", your resolver answers queries from any source and should be restricted immediately.Related Topics
Attackers abusing DNS for amplification often use the same open resolvers exploited for tunneling.
NXDOMAIN AttacksNXDOMAIN floods share the same amplification-via-open-resolver attack surface.
Recursive ResolverOpen recursive resolvers are the primary attack vector — Response Rate Limiting is configured there.