DNS DDoS Protection

DNS DDoS Protection

Protect your DNS infrastructure from advanced DNS DDoS attacks

Contact us

Protecting DNS is Critical for Your Business

DNS DDoS protection safeguards name resolution services and prevents attackers from knocking your domain offline using massive query floods or malformed requests. It keeps the DNS infrastructure behind your websites, services and APIs available, even during large-scale or zero-day attack campaigns.

Radware’s DDoS Protection solutions use behavioral-based detection and automatic real-time signatures to identify and automatically block today’s most advanced DNS DDoS attacks. These DNS DDoS defenses leverage adaptive and multilayered protection that can be flexibly deployed—appliance, cloud-based and hybrid—to suit every customer’s need and deployment architecture.

How DNS DDoS protection works

Number one

Anycast and distributed scrubbing

Spreads traffic across a global network of Points of Presence (PoPs) so no single server absorbs the entire attack.

Number two

Query filtering and inspection

Analyzes DNS packets in real time to drop floods, NXDOMAIN floods, water torture and amplification attacks.

Number three

Anti-spoofing and rate controls

Challenges spoofed sources and curbs excessive query rates while legitimate user traffic passes through.

Number four

Behavioral analytics and AI

Uses machine learning and anomaly detection to identify zero-day and randomized query attacks that bypass signatures.

Common DNS DDoS attack vectors

  • DNS amplification / reflection

    • Small spoofed requests trigger large DNS responses directed at the victim's IP address.

  • DNS flood

    • Botnets send a massive volume of DNS requests until the target DNS server becomes unresponsive.

  • DNS water torture (random subdomains)

    • Queries for randomized, non-existent subdomains exhaust the authoritative name server's resources.

  • NXDOMAIN flood

    • Queries for domains that do not exist overwhelm resolvers or authoritative servers.

  • Phantom domain

    • Requests to resolve non-responsive phantom domains tie up the victim's DNS server.

Protecting Critical DNS Infrastructure

DNS is critical Internet infrastructure; every web transaction involves a DNS service provided by an Internet service provider. An attack against DNS services that manages to disrupt these services will halt all other Internet-based services.

Read The White Paper

Safeguard Your Infrastructure, Availability and Customer Trust

Based on DNS behavioral protection modules from DefensePro X and cloud DDoS services, Radware’s DNS DDoS attack protection offers:

Protection Against Any DNS DDoS attack

Protection Against Any DNS DDoS attack

Real-time detection and mitigation of both known and zero-day DNS DDoS attacks, ensuring that networks and services remain accessible and resilient

Automated machine learning protection

Automated Machine-learning Protection

Multi-layered, patented and adaptive solution to accurately detect and mitigate attack campaigns while minimizing false positives

shorter time-to-mitigate (TTM)

Shorter Time to Mitigate (TTM)

Autonomous management of detection, characterization and mitigation without human intervention lowering the overall TTM

Lower total cost of ownership (TCO)

Lower Total Cost of Ownership (TCO)

Configuration management and handling of ongoing attacks is fully automated, leading to significantly lower costs

Flexible Deployment

Flexible Deployment

Cloud services, appliances and hybrid solutions to match any customer use case, environment or architecture

Fully Managed Security Service

Fully Managed Security Service

Real-time support from the 120 battle-proven security experts on Radware’s Emergency Response Team (ERT)

Types of DNS DDoS Attacks

DNS Amplification Attack

Attackers exploit misconfigured DNS servers, making the DNS response much larger than the DNS request. The attacker sends a large number of small DNS queries with a spoofed source IP address to the targeted DNS server. The server then sends the amplified responses to the victim's IP address, overwhelming its network capacity

What is DNS Amplification Attack? Cover image
 

DNS Flood Attack

Attackers utilize a network of compromised computers called botnets to send a massive volume of DNS requests to the target DNS server, which floods the DNS server and causes it to become unresponsive

DNS Water Torture / DNS Random Sub-domain Attack

Attackers send a constant stream of small, legitimate-looking DNS queries to the victim's DNS server at a slow and steady rate. The continuous flow of queries gradually overwhelms the DNS server's resources and causes complete unresponsiveness over time. The queries target randomized, non-existent subdomains of the victim's domain (for example, a1b2c3.yourdomain.com), so they bypass resolver caches and flood the authoritative name server, exhausting its resources

NXDOMAIN Flood Attack

Attackers overwhelm DNS resolvers or authoritative servers with a high volume of queries for domains that do not exist. Each query forces the server to attempt resolution and return an NXDOMAIN (non-existent domain) response, consuming server resources until legitimate queries go unanswered

Phantom Domain Attack

Attackers set up one or more phantom domains and send requests to the victim's DNS server to resolve the phantom domains. The victim's DNS server gets overwhelmed when it tries to resolve the phantom domains through non-responsive servers

Incident Brief

Radware Protects Major Bank Against DNS DDoS Campaign

A large European Bank, which includes over 8,000 branches serving more than 150 million customers worldwide, first became a target of the large-scale DNS DDoS campaign in January of 2023.

Read more
Infographics

Threat Spotlight: DNS Attacks

Watch out for these four Domain Name System Attacks (DNS) if you want to keep your organization up and running.

Read more
Solution Brief

AI-powered and Rule-free: The New DNS DDoS Protection

Learn how our new AI-powered, rule-free DNS DDoS protection stops the most sophisticated DNS DDoS attack campaigns.

Read more
White Papers

Protecting Critical DNS Infrastructure

Find out how Radware's AI-powered, rule-free proteciton stops even the most sophisticated DNS DDoS attacks.

Read more

Contact Radware Sales

Our experts will answer your questions, assess your needs, and help you understand which products are best for your business.

Contact Us Now

Already a Customer?

We’re ready to help, whether you need support, additional services, or answers to your questions about our products and solutions.

Locations
Get Answers Now from KnowledgeBase
Get Free Online Product Training
Engage with Radware Technical Support
Join the Radware Customer Program

Get Social

Connect with experts and join the conversation about Radware technologies.

Blog
Security Research Center
CyberPedia

Close

CyberPedia