DNS Amplification Attack: How It Works & 5 Ways to Stop It

• IP spoofing: The malicious actor sends numerous DNS queries to publicly accessible, open DNS resolvers. In these queries, the attacker manipulates the source IP address, replacing it with the victim's actual IP address.
• Sending DNS queries to open resolvers: The attacker sends spoofed requests to many publicly accessible DNS resolvers, causing each server to direct its response to the victim's IP address.

• Generating amplified DNS responses: The attacker specifically crafts queries (such as requesting ANY records or utilizing DNS Security Extensions like EDNS0) to ensure the response size is significantly larger than the request itself.
• Overwhelming the target with traffic: The combined DNS responses flood the victim's network, exhausting bandwidth and infrastructure capacity until legitimate users can no longer access services.

• Risks and Business Impact of DNS Amplification Attacks
• How Does a DNS Amplification Attack Work?
• DNS Amplification vs. DNS Reflection

• Common DNS Queries Used for Amplification
• Signs of a DNS Amplification Attack
• How to Mitigate an Active DNS Amplification Attack

• Service outages: High traffic volumes can overwhelm network links, load balancers, firewalls, or applications, making websites, APIs, and other services unavailable.
• Revenue loss: Downtime can interrupt online sales, customer transactions, and subscription services.
• Poor user experience: Slow response times and unavailable services can frustrate customers and reduce trust.
• Higher infrastructure costs: Organizations may need additional bandwidth, DDoS mitigation services, or cloud resources.

• Operational disruption: Security and IT teams must divert time and resources to incident response.
• Reputational damage: Repeated or prolonged outages can harm customer confidence and affect relationships with partners and clients.
• Collateral impact on other services: Saturated network connections can affect unrelated applications, internal systems, VPN access, and communication services that share the same infrastructure.
• Potential SLA violations: Organizations that provide online services may fail to meet service level agreements.

1. IP Address Spoofing

IP address spoofing is a core tactic in DNS amplification attacks. Attackers manipulate packet headers to forge the source IP address, making it appear that requests originate from the target rather than the attacker's device. This is possible because DNS over UDP does not verify the source IP.

By spoofing the victim's IP address, attackers ensure that DNS responses from open resolvers are sent to the target. This makes tracing the attack difficult and increases its impact without exposing the attacker's infrastructure.

2. Sending DNS Queries to Open Resolvers

Attackers target open DNS resolvers, servers configured to respond to DNS queries from any IP address. These resolvers are often poorly secured and widely available on the internet. Attackers compile lists of such resolvers and automate the process of sending spoofed DNS queries to many of them.

Open resolvers do not verify whether the requester is authorized to use the service. This lack of access control allows attackers to send large numbers of queries and generate amplified responses directed at the victim's network.

3. Generating Amplified DNS Responses

Amplification comes from the difference between the size of the DNS query and the response it generates. Attackers craft queries, often for records like ANY or DNSSEC, that prompt the resolver to send back large responses. A query of a few dozen bytes can trigger a response of several thousand bytes.

This ratio allows attackers to multiply their outbound bandwidth. The victim must handle the full volume of amplified responses, which can saturate the network and disrupt services.

4. Overwhelming the Target with Traffic

Once the attack begins, the victim's network receives a flood of unsolicited DNS responses. Incoming traffic can saturate bandwidth, overwhelm firewalls or routers, and consume server resources. Legitimate traffic may be dropped or delayed, causing partial or total service outages.

The goal is to make online services inaccessible to legitimate users. In severe cases, upstream providers or neighboring networks may also be affected. Recovery often requires help from internet service providers or DDoS mitigation services to filter or block malicious traffic.

ANY Queries

ANY queries request all available DNS record types for a domain in a single response. Instead of returning a single record such as an A or MX record, the server may include multiple resource records if it supports this query type. This can make the response much larger than the original request, creating a favorable amplification ratio.

Although many authoritative DNS servers now limit or refuse ANY queries to reduce abuse, not all servers implement these protections. Older DNS software, misconfigured servers, and some recursive resolvers may still generate large responses. Attackers scan for these systems and include them in lists of vulnerable resolvers.

The effectiveness of ANY queries depends on both the server implementation and the domain being queried. Domains with many published records produce larger responses than domains with only a few records. Even though ANY queries are less effective than they once were, they remain a technique used against systems that still support them.

DNSSEC-Enabled Queries

DNSSEC adds cryptographic signatures to DNS data so clients can verify that responses have not been modified. To perform this validation, DNS responses include additional records such as RRSIG, DNSKEY, NSEC, and DS records. These records increase the amount of data returned for many DNS queries.

Attackers specifically target DNSSEC-enabled domains because they can generate responses several times larger than standard DNS replies. A relatively small request can produce a response containing multiple signature records and public keys, increasing the amplification factor.

The larger packet sizes created by DNSSEC are a necessary part of securing DNS, not a vulnerability in DNSSEC itself. The attack becomes possible only when open resolvers accept spoofed requests and return these larger responses to the victim. Organizations should therefore secure resolvers rather than disable DNSSEC.

TXT Record Queries

TXT records store arbitrary text associated with a domain. They are commonly used for SPF policies, DKIM public keys, DMARC configurations, domain ownership verification, and other application-specific information. Some TXT records, particularly DKIM keys, can be several hundred bytes long.

When a DNS server returns one or more large TXT records, the response can be much larger than the original query. Attackers choose domains with extensive TXT records because they provide better amplification than domains with only small text entries.

Large organizations often publish multiple TXT records for different services, increasing the overall response size. Attackers may identify these domains during reconnaissance and repeatedly query them through open resolvers to maximize reflected traffic.

MX Record Queries

MX record queries retrieve the list of mail servers responsible for accepting email for a domain. Each MX record identifies a mail server and includes a priority value that determines the order in which servers should be contacted.

The response may also include additional records, such as the IP addresses of the listed mail servers, to reduce the number of follow-up DNS lookups. Domains that use multiple mail providers, redundant gateways, or geographically distributed email infrastructure can therefore produce larger responses.

While MX queries generally provide a lower amplification factor than DNSSEC or large TXT records, they are still useful to attackers because they are widely supported and consistently generate responses larger than the request. They are often combined with other query types during large-scale attacks.

Extension Mechanisms for DNS (EDNS) extend the original DNS protocol to support larger UDP messages and additional protocol features. Instead of being limited to 512-byte UDP responses, EDNS allows clients to advertise support for much larger packet sizes, often several kilobytes.

Attackers include EDNS options in spoofed DNS queries to encourage resolvers to return larger UDP responses. When the requested records include DNSSEC signatures or other large datasets, the resulting packets can be several thousand bytes long, greatly increasing the amplification ratio.

Larger responses also increase the total amount of bandwidth consumed by the attack. Even if responses are fragmented during transmission, they still place a significant load on the victim's network and upstream infrastructure. For this reason, EDNS is commonly used alongside DNSSEC queries to maximize attack volume.

Sudden Increase in UDP Traffic

One of the earliest indicators of a DNS amplification attack is a sharp increase in inbound UDP traffic. Because DNS typically uses UDP for queries and responses, attackers can generate large traffic spikes in a short period of time without establishing TCP connections.

The increase is usually much larger than normal DNS activity and may originate from thousands of different IP addresses. Monitoring systems often detect:

• Unusually high packet rates
• Increased network utilization
• A surge in DNS-related traffic

If the affected organization does not normally receive large volumes of DNS traffic, the change is often immediately noticeable.

Large Volumes of Traffic on Port 53

DNS amplification attacks generate a large number of packets destined for UDP port 53, the standard port used for DNS. Although the traffic comes from legitimate DNS resolvers, the overall volume is abnormal and can quickly overwhelm network infrastructure.

Tools that may report a sudden increase in traffic associated with port 53 include:

• Network monitoring tools
• Firewalls
• Intrusion detection systems

The responses often originate from many DNS servers across different networks, making the attack appear distributed and more difficult to block using simple IP-based filtering.

DNS Responses Without Matching Requests

A key characteristic of DNS amplification attacks is that the victim receives DNS responses it never requested. Because attackers spoof the victim's IP address when sending queries, open DNS resolvers send their responses directly to the target instead of the attacker.

Systems may show thousands of unsolicited DNS responses without corresponding outbound queries:

• DNS logs
• Packet captures
• Network monitoring tools

This mismatch is a strong indicator of a reflection attack and helps distinguish DNS amplification from normal increases in DNS activity caused by legitimate users.

Bandwidth Saturation

As amplified DNS responses accumulate, the victim's internet connection may become fully utilized. Available bandwidth is consumed by malicious traffic, leaving little capacity for legitimate users and applications. This often results in slow response times, dropped connections, or complete service outages.

Bandwidth saturation can also affect systems that are not directly targeted. Services sharing the same network connection may experience degraded performance because they compete for limited network capacity, including:

• VPNs
• Email servers
• Cloud applications
• Voice communications

Monitoring bandwidth utilization and interface statistics can help identify this symptom early and trigger mitigation measures before services become completely unavailable.

1. Use Behavioral and Signature-Based Protection Together

Behavioral detection identifies traffic patterns that differ from normal network activity, such as sudden spikes in DNS responses, unusually high packet rates, or traffic from a large number of DNS resolvers. Because it focuses on anomalies rather than known attack patterns, it can detect new or modified attack techniques.

Signature-based protection complements this approach by identifying known characteristics of DNS amplification attacks, such as specific packet structures, protocol fields, or attack fingerprints. Using both methods together improves detection accuracy, allowing security systems to respond quickly while reducing false positives.

Key actions:

• Establish baselines for normal DNS and UDP traffic.
• Detect sudden increases in packet rates and response volumes.
• Apply signatures for known DNS amplification patterns.
• Correlate alerts across firewalls, routers, and monitoring systems.
• Tune detection rules regularly to reduce false positives.

2. Block or Filter Malicious UDP Traffic

During an active attack, network devices should filter malicious UDP traffic before it reaches critical systems. Firewalls, routers, and DDoS mitigation platforms can apply filtering rules based on source reputation, packet characteristics, protocol behavior, or traffic rate to remove unwanted DNS responses.

Because DNS amplification attacks use legitimate DNS servers, blocking all DNS traffic is usually not practical. Filtering should instead focus on identifying unsolicited DNS responses and abnormal traffic patterns while allowing legitimate DNS communication to continue. Internet service providers may also apply upstream filtering to reduce the attack before it reaches the victim's network.

Key actions:

• Filter unsolicited DNS responses at network boundaries.
• Block malformed packets and traffic from known abusive sources.
• Apply protocol validation to incoming UDP traffic.
• Coordinate with the internet service provider for upstream filtering.
• Preserve legitimate DNS traffic through targeted rules.

3. Use Anycast DNS Infrastructure

Anycast routes traffic to multiple geographically distributed servers that share the same IP address. Incoming requests are automatically directed to the nearest or most available location based on internet routing protocols. This distributes traffic across many data centers instead of concentrating it at a single location.

During a DNS amplification attack, Anycast helps absorb large traffic volumes by spreading the load across multiple sites. Even if one location experiences high traffic, other locations continue serving legitimate users. Although Anycast does not stop the attack itself, it increases resilience and makes it more difficult for attackers to overwhelm the entire service.

Key actions:

• Distribute DNS services across multiple geographic locations.
• Advertise the same IP address from several data centers.
• Monitor traffic loads and routing health at each location.
• Maintain sufficient capacity to absorb regional traffic spikes.
• Test failover between Anycast nodes regularly.

4. Redirect Traffic Through a DDoS Scrubbing Service

A DDoS scrubbing service acts as an intermediary between the internet and the target network. During an attack, traffic is redirected to the provider, where specialized systems analyze packets and remove malicious traffic before forwarding legitimate traffic to the organization.

Scrubbing providers operate large, globally distributed networks with significantly more bandwidth than most organizations can deploy on their own. They use traffic analysis, filtering, rate limiting, and protocol validation to identify DNS amplification traffic while minimizing the impact on legitimate users. This approach is particularly effective against attacks that exceed the organization's available internet capacity.

Key actions:

• Preconfigure traffic diversion through BGP or DNS changes.
• Define thresholds that trigger automatic scrubbing.
• Confirm that the provider can handle large UDP floods.
• Test traffic redirection before an incident occurs.
• Review mitigation reports after each attack.

Rate limiting reduces the number of packets or requests that systems process over a given period. While it cannot stop a large-scale DNS amplification attack on its own, it can help protect individual services and network devices from becoming overloaded. Rate limits are commonly applied on firewalls, routers, load balancers, and DNS servers.

Access control lists (ACLs) provide another layer of defense by allowing or denying traffic based on IP addresses, protocols, ports, or other packet attributes. During an attack, ACLs can block traffic from known malicious sources or restrict unnecessary DNS traffic to trusted systems. When combined with upstream filtering and DDoS mitigation services, rate limiting and ACLs help reduce the impact of ongoing attacks.

Key actions:

• Limit DNS and UDP traffic to acceptable rates.
• Restrict DNS communication to approved systems where possible.
• Block unnecessary inbound traffic on UDP port 53.
• Update ACLs with current threat intelligence.
• Monitor dropped traffic to avoid blocking legitimate users.

• Protection against any DNS DDoS attack: Provides real-time detection and mitigation of both known and zero-day DNS DDoS attacks, keeping networks and services accessible and resilient throughout an attack.
• Automated machine-learning protection: Uses a patented, multilayered, and adaptive approach to accurately detect and mitigate attack campaigns while minimizing false positives.
• Shorter time to mitigate (TTM): Autonomously manages detection, characterization, and mitigation without human intervention, lowering the overall time it takes to neutralize an attack.

• Lower total cost of ownership (TCO): Fully automates configuration management and the handling of ongoing attacks, which significantly reduces operating costs.
• Flexible deployment: Offers cloud services, on-premise appliances, and hybrid models to match any use case, environment, or architecture.
• Fully managed security service: Backs the technology with real-time support from Radware's Emergency Response Team (ERT), staffed by battle-proven security experts.