What Are DNS DDoS Attacks? DNS Flood, Amplification and DNS Security

A website may be running perfectly.

The servers may be healthy.

The application may be responding without errors.

Firewall, WAF and CDN may all be in place.

But if the user cannot translate the domain name into an IP address, they still cannot reach the service.

DNS – the domain name system is therefore one of the most critical infrastructure components of internet availability.

And precisely for that reason DNS services are frequently targeted in DDoS attacks.

Rather than targeting the web application directly, an attacker can strain;

authoritative DNS servers,

recursive DNS services,

DNS query capacity,

network bandwidth.

The result is that while the web server keeps running, users experience the problem:

“The site won't load.”

In corporate DDoS security, therefore, the concepts of DNS DDoS, DNS flood, DNS amplification, DNS reflection, random subdomain attacks, DNS water torture, anycast DNS, secondary DNS and DNS resilience must be assessed under a separate heading.

The fundamental question is this:

Even if your critical services are running, can your organisation keep serving if DNS fails?

What Is DNS DDoS?

A DNS DDoS attack is an attack type aimed at slowing or disabling domain resolution by consuming the DNS infrastructure's query processing capacity, bandwidth or other resources.

DNS attacks can be carried out in various ways.

Different behaviours can be seen, such as;

• DNS query flood,
• DNS amplification,
• DNS reflection,
• random subdomain attack,
• DNS water torture,
• NXDOMAIN flood.

Each stresses a different point.

Not every attack targets the same place.

Some focus on high traffic volume while others strain the DNS server's processing capacity or cache behaviour.

Why Is DNS So Critical?

DNS is the internet's fundamental name resolution mechanism.

When a user types:

www.company.com

the system learns which IP address to connect to through DNS.

When DNS is not working, the user generally cannot reach the server at all.

The critical point is this:

Application availability and DNS availability are not the same thing.

The application may be up.

But if DNS does not respond, the service is down from the user's point of view.

DDoS resilience must therefore not be assessed at the web and network layers alone.

What Is Authoritative DNS?

An authoritative DNS server is the server providing the official DNS records for a particular domain.

Records such as;

A,

AAAA,

MX,

TXT,

CNAME

can be held on authoritative DNS.

If an attacker makes the authoritative DNS infrastructure unreachable, users have trouble resolving the domain.

Authoritative DNS infrastructure must therefore be highly available for corporate web services in particular.

What Is Recursive DNS?

A recursive DNS resolver is the system that completes domain resolution by sending queries to various DNS servers on the user's behalf.

ISP or corporate network users may use a recursive resolver.

Recursive DNS and authoritative DNS have different roles.

For DDoS security it matters to understand correctly which DNS component is being targeted.

What Is a DNS Flood?

A DNS flood is an attack aimed at exhausting service capacity by sending very high volumes of queries to a DNS server.

The aim may be to strain;

CPU,

memory,

network bandwidth,

query processing,

socket

resources.

If the DNS service normally handles:

20,000 QPS

it may receive during the attack:

500,000 QPS

instead.

If the infrastructure cannot carry that load, genuine users' queries time out.

What Is QPS?

Queries per second (QPS) shows the number of queries the DNS infrastructure processes per second.

It is an important performance metric in DNS DDoS testing.

An organisation should not merely say:

“Our DNS server is strong.”

It must answer these questions:

What is normal QPS?

What is peak QPS?

What is the maximum sustainable QPS under attack?

At which QPS level does latency rise?

These values help measure the DNS resilience level.

What Is DNS Amplification?

DNS amplification is a DDoS attack method in which the attacker turns small DNS queries into larger response traffic directed at another target.

This attack generally works with the reflection mechanism.

The attacker sends a query to a DNS server.

But they show the victim's IP as the source address.

The DNS server sends the response not to the attacker but to the target system.

If the response is far larger than the query, the traffic has been amplified.

What Is DNS Reflection?

DNS reflection is the attacker bouncing their traffic off DNS servers rather than sending it directly to the target.

The general flow can be thought of as:

Attacker

↓

spoofed DNS request

↓

DNS Server

↓

large DNS response

↓

Victim

The attacker's real IP may never be directly visible.

The traffic the target sees appears to come from many different DNS servers.

That makes the attack harder to filter.

What Is the Amplification Factor?

The amplification factor expresses the ratio between the data the attacker sends and the response volume reaching the target.

The attacker sends a 100-byte request, for example.

If the DNS server produces a 3,000-byte response, a serious amplification effect forms.

In amplification attacks the outbound capacity the attacker needs can therefore be far lower than the traffic created at the target.

The Difference Between DNS Flood and DNS Amplification

These two attacks are different.

DNS Flood

Targets the DNS service directly.

The aim is to exhaust the DNS server's query processing capacity.

DNS Amplification

Uses the DNS infrastructure to generate traffic against another target.

The DNS server is therefore not the victim in the attack but part of the attack tooling.

This distinction matters for the defensive strategy.

What Is an Open Resolver?

An open DNS resolver is a resolver that accepts recursive DNS queries from any client on the internet.

Misconfigured open resolvers can be abused in reflection and amplification attacks.

Organisations must therefore not leave recursive DNS services unnecessarily exposed to the internet.

A recursive resolver should serve only authorised users or networks.

Why Must DNS Recursion Be Controlled?

Recursive queries can require the server to communicate with other DNS infrastructure.

That process consumes a certain amount of resource.

If anyone on the internet can use the recursive resolver, the risks of;

abuse,

resource consumption,

amplification

all increase.

Recursion should therefore be open only to the sources that need it.

What Is a Random Subdomain Attack?

A random subdomain attack is the attacker continuously generating DNS queries for different, random subdomains.

For example:

a9321.company.com

r4233.company.com

random8472.company.com

and so on.

These domains may not exist in reality.

But each new name creates additional processing on the DNS infrastructure.

The aim is particularly to reduce the effect of the cache mechanism.

What Is a DNS Water Torture Attack?

DNS water torture is an attack model related to the random subdomain approach.

By sending large numbers of different subdomain queries, the attacker can force recursive resolvers to keep forwarding new queries to the authoritative DNS.

If a cached name such as:

www.company.com

is queried repeatedly, the resolver can answer from cache.

But if new queries such as:

x9238.company.com

r8172.company.com

keep arriving, the resolver has to go to the authoritative DNS.

This increases the load on the authoritative server.

What Is an NXDOMAIN Flood?

For queries about non-existent domains or subdomains, DNS generally returns an NXDOMAIN response.

By querying large numbers of non-existent records, the attacker can create processing load on the DNS infrastructure.

This behaviour can be called an NXDOMAIN flood.

These attacks are often seen together with random subdomain techniques.

How Does Caching Help in DNS DDoS?

DNS caching allows previously resolved records to be answered without going to the authoritative server when queried again.

This means;

latency falls,

authoritative server load drops.

But random subdomain attacks try to reduce the cache advantage.

Because every query is unique, no cache hit occurs.

What Is Negative Caching?

Negative caching is the caching of NXDOMAIN responses for non-existent DNS records for a certain period.

This mechanism reduces the number of times the same faulty query reaches the authoritative server.

But if the attacker uses a different random subdomain each time, its effect is limited.

How Does TTL Affect DNS DDoS Resilience?

Time to live (TTL) determines how long a DNS record is held in resolver caches.

A high TTL;

reduces the query volume on the authoritative DNS.

But propagating changes during updates and failover takes longer.

A low TTL;

allows faster DNS changes,

but more queries reach the authoritative DNS.

TTL settings must therefore be balanced against availability and operational requirements.

What Is Anycast DNS?

Anycast DNS is the architecture allowing the same DNS service IP to be announced from different geographic locations.

A user's DNS query is generally routed to the most suitable point in network terms.

It provides an important advantage for DDoS.

Attack traffic spreads across a wide distributed infrastructure rather than converging on a single server or data centre.

Anycast is therefore widely used in large DNS services.

Does Anycast DNS Block DDoS on Its Own?

No.

Anycast can distribute the attack load.

But filtering the malicious traffic also requires;

DDoS mitigation,

rate limiting,

traffic analysis.

Anycast provides great capacity and distribution.

But it does not replace an attack filtering algorithm.

The Difference Between Unicast DNS and Anycast DNS

Unicast

A given IP mostly represents a single network location.

Anycast

The same IP can be advertised from different locations.

For DDoS, an anycast architecture helps distribute the attack load geographically.

It can therefore offer an important resilience advantage for critical internet services.

What Is Secondary DNS?

Secondary DNS is the approach of publishing the same DNS zone on more than one independent DNS infrastructure.

When the main DNS provider has a problem, the second provider continues responding.

This method reduces dependence on a single provider.

But configuration and zone synchronisation must be managed carefully.

What Is Multi-Provider DNS?

Multi-provider DNS means a critical domain being served through more than one independent DNS provider.

This approach can provide resilience against events such as;

DDoS,

a provider outage,

a routing problem.

It is considered particularly for highly critical digital services.

But the providers' configurations must remain consistent.

What Is a DNS SPOF?

A single point of failure (SPOF) describes a structure where the failure of one component halts the entire service.

If DNS runs through a single provider or a single server, it forms a SPOF.

A DDoS attack can target that single point.

Redundancy is therefore critically important in DNS architecture.

Should Authoritative DNS Servers Sit on the Same Network?

In systems requiring high availability, having all DNS servers on the same;

data centre,

network,

ISP

creates a risk.

If that same upstream connection comes under DDoS impact, the whole DNS infrastructure becomes unreachable.

Geographic and network-based distribution raises the resilience level.

What Is DNS Rate Limiting?

DNS services can apply rate limiting for particular query types or clients.

The aim is to reduce the attack's intensity.

Response rate limiting (RRL) in particular can be considered for reducing DNS amplification risk.

But if the limits are misconfigured, genuine queries are affected too.

The baseline and legitimate traffic behaviour must therefore be known.

What Is Response Rate Limiting (RRL)?

RRL helps limit a DNS server sending very high volumes of responses to similar queries.

It particularly reduces the server being abused as an attack source in spoofed reflection/amplification attacks.

But RRL does not solve every DNS attack.

Additional controls may be needed for a random subdomain flood targeting the authoritative server directly, for instance.

Does DNSSEC Provide DDoS Protection?

DNSSEC – domain name system security extensions is a security mechanism used for the integrity and verifiability of DNS responses.

Its core purpose is not DDoS protection.

It provides different benefits against security problems such as DNS spoofing and response tampering.

And because DNSSEC responses can in some cases be larger, they must be considered in an amplification context on misconfigured systems.

It should therefore be thought of as:

DNSSEC ≠ DDoS protection

What Is a DNS Firewall?

A DNS firewall is a mechanism that helps filter domain queries according to security policies.

For example;

malicious domains,

phishing,

C2 domains

can be blocked.

But a DNS firewall is not an alternative to volumetric DNS DDoS protection either.

It mainly provides DNS-based threat blocking and policy enforcement.

Are DNS DDoS and DNS Tunnelling the Same Thing?

No.

DNS DDoS

targets availability.

DNS Tunnelling

describes the abuse of DNS traffic for data transfer or command & control.

In one the objective is a service outage.

In the other it is covert communication or data transfer.

For the SOC these are two different detection scenarios.

What Are the Signs of a DNS DDoS Attack?

Possible signs are;

a QPS increase,

rising DNS response time,

an increase in timeouts,

a sudden rise in the NXDOMAIN rate,

random subdomain diversity,

a CPU increase,

rising network bandwidth,

a falling cache hit ratio.

But these signals do not prove an attack on their own.

They must be compared against genuine user behaviour.

Why Should the NXDOMAIN Rate Be Monitored?

Seeing a certain proportion of NXDOMAIN responses is natural in a normal environment.

Users mistype domains.

Applications request faulty records.

But an unusual rise in the NXDOMAIN rate can indicate a random subdomain attack or DNS abuse.

The baseline therefore becomes important.

What Is the Unique Query Rate?

In random subdomain attacks most of the queries differ from one another.

Not only total QPS but also;

unique query count

can therefore be monitored.

While the same popular records are normally queried repeatedly, the proportion of unique names rises during an attack.

This behaviour can be valuable for detection.

Why Does DNS Cache Hit Ratio Matter?

In normal DNS behaviour, frequently used records are answered from cache.

If the cache hit ratio falls rapidly during an attack, the authoritative query load rises.

For that reason;

a QPS increase

a rise in unique queries

a falling cache hit ratio

together form a meaningful attack signal.

How Is DNS DDoS Detected?

For detecting DNS attacks;

DNS logs,

network flow,

packet telemetry,

server metrics,

DDoS platform events

can be used.

These behaviours in particular can be analysed:

Query Rate

Query Type Distribution

NXDOMAIN Rate

Unique Subdomain Rate

Source Diversity

Response Size

Latency

This information helps identify the attack type.

Why Does Query Type Distribution Matter?

In normal DNS traffic, query types such as;

A,

AAAA,

MX,

TXT

have a particular distribution.

During an attack a single query type can rise unusually.

This behaviour helps identify the attack pattern.

But an attacker can use different query types to make that simple detection harder.

Source IP Analysis in DNS DDoS

Distributed attacks show large numbers of source IPs.

In a reflection attack the sources seen may not be the real attacker systems.

Building a defence on source IP blocking alone is therefore not enough.

Behavioural analysis matters more.

Geo-Distribution Analysis

A DNS attack may come from many different countries.

But for organisations with a global user base that can be normal.

Geography alone is therefore not an attack indicator.

A local organisation serving Türkiye suddenly receiving DNS queries from thousands of regions it normally sees no traffic from is far more meaningful.

Botnet Use in DNS DDoS

Botnets can be used for DNS query floods.

Thousands of different devices can query the same authoritative DNS.

Stopping that attack with per-IP rate limiting is difficult.

Even if each bot generates low QPS, the total load can be high.

Distributed behaviour detection is therefore important.

How Can Recursive Resolvers Protect Organisations?

Thanks to caching, recursive resolvers reduce the number of repeated queries reaching the authoritative DNS.

But random subdomain attacks try to defeat that.

The authoritative DNS service's own DDoS resilience therefore matters separately.

Why Is Upstream Protection Necessary in DNS DDoS?

If the traffic arriving at the DNS server exceeds the network capacity, rate limits on the local server may not be enough.

The traffic must be filtered at the upstream level.

Solutions such as;

a cloud DNS provider,

an anycast network,

anti-DDoS,

ISP protection

can therefore be considered.

Does Cloud DNS Provide an Advantage Against DDoS?

Large cloud DNS providers can have advantages such as;

globally distributed infrastructure,

anycast,

high capacity,

automated mitigation.

They can therefore provide higher resilience than running a few DNS servers in your own data centre.

But provider dependency and configuration risks must still be assessed.

How Does DNS Failover Work?

DNS-based failover mechanisms can direct users to a secondary endpoint when the primary service is unhealthy.

But if DNS itself is under attack, the failover mechanism may not work either.

DNS availability and application failover must therefore be designed together.

Is a Low TTL an Advantage or a Disadvantage During DDoS?

It can be either.

A low TTL;

allows failover changes to propagate quickly.

But it makes resolvers send authoritative DNS queries more often.

That load rises under attack.

A high TTL provides a cache advantage but propagates routing or failover changes more slowly.

There is therefore no single correct TTL.

Does It Make Sense to Change DNS Records During a DDoS Attack?

In some incident response scenarios traffic can be directed to a different service.

But if the existing DNS records have high TTL values, the change does not reach all users immediately.

Rather than thinking about changing DNS during a crisis, the DNS failover strategy must therefore be designed in advance.

What Should DNS DDoS Incident Response Look Like?

When a DNS attack is detected;

the attack type must be identified,

authoritative and recursive impact must be separated,

the provider must be contacted,

QPS and response latency must be monitored,

rate limiting or mitigation must be applied,

secondary DNS must be engaged if necessary,

application availability must be checked separately.

The SOC and network/DNS teams must work in coordination.

What Should the SLA with a DNS Provider Look Like?

For critical DNS services, criteria beyond uptime can be assessed, such as;

DDoS mitigation,

global capacity,

response latency,

support response time,

incident notification.

The provider's technical response competence matters particularly during DDoS attacks.

What Is a DNS DDoS Test?

A DNS DDoS test is the measurement of the resilience of authoritative or related DNS infrastructure under controlled query intensity.

During the test;

QPS,

latency,

timeouts,

CPU,

network traffic,

cache behaviour,

mitigation

can be measured.

But production DNS tests must be carried out carefully.

Because a DNS outage creates very broad service impact.

Which Scenarios Can Be Used in DNS DDoS Testing?

Within an authorised test, scenarios such as;

Standard Query Flood

normal query intensity.

NXDOMAIN Flood

queries for non-existent records.

Random Subdomain Simulation

unique subdomain queries.

High QPS Test

query capacity.

can be assessed in a controlled way.

Stop conditions must be defined in advance for every test.

What Should Be Measured in a DNS DDoS Test?

The most important metrics include;

Maximum Sustainable QPS

Average Response Time

P95 / P99 DNS Latency

Timeout Rate

NXDOMAIN Rate

CPU / Memory

Bandwidth

Mitigation Time

Legitimate Query Success Rate

each of which adds a dimension.

These values make the DNS resilience level far more objective.

What Are P95 and P99 DNS Latency?

Average response time can hide certain problems.

95% of queries may be fast while 5% are very slow, for instance.

P95

shows that 95% of queries are faster than this figure.

P99

shows the 99th percentile performance level.

Percentile metrics can be far more meaningful for understanding user experience under DDoS.

Should DNS Monitoring Be Integrated with the SOC?

Yes.

DNS is a highly critical telemetry source.

The SOC can monitor behaviours such as;

QPS anomalies,

NXDOMAIN spikes,

random subdomains,

known malicious domains,

C2 patterns.

DNS can thereby be used for detecting both DDoS and other threats.

How Is a SIEM Used in DNS DDoS Detection?

A SIEM can combine different signals.

For example:

a DNS QPS increase

a rising NXDOMAIN rate

an authoritative CPU increase

an application availability problem

can be correlated under the same incident.

This approach reduces the number of false alarms.

How Does NDR See DNS DDoS?

At network level, NDR can analyse;

DNS traffic volume,

source distribution,

query behaviour,

packet patterns.

The attack's network effects, invisible in DNS server logs, can thereby be detected too.

How Long Should DNS Logs Be Retained?

There is no single standard period.

It varies by regulation, corporate policy and storage capacity.

But from a security perspective, historical DNS data is extremely valuable for;

threat hunting,

incident response,

DDoS forensic analysis.

An adequate retention policy must therefore be established.

The Relationship Between DNS DDoS and Threat Intelligence

Through threat intelligence, information can be obtained about actively used;

botnets,

amplification methods,

malicious infrastructure,

DDoS campaigns.

That information can be used to update DDoS test scenarios and detection policies.

The Relationship Between DNS DDoS and Ransom DDoS

Some threat actors use DDoS attacks for extortion.

This approach can be called ransom DDoS (RDoS).

The attacker carries out a short attack and demands payment under threat of a larger one.

Targeting critical infrastructure such as DNS increases the impact of these attacks.

What Should Be Done When an RDoS Message Arrives?

Whether the threat message is genuine must be assessed professionally.

The organisation must coordinate its;

SOC,

incident response,

network,

legal,

management

teams.

Readiness levels with the DDoS provider and ISP must also be verified.

Panic action must not be taken purely because the message exists.

What Is the Biggest Mistake in DNS DDoS Protection?

One of the biggest mistakes is leaving DNS outside the critical security scope because “it's already working”.

An organisation may be using;

a high-capacity firewall,

a strong WAF,

a CDN,

anti-DDoS.

But if DNS runs on two small servers in a single data centre, the whole service depends on that.

DNS security must therefore be a separate heading in every DDoS readiness assessment.

Corporate DNS DDoS Protection Architecture

A strong DNS architecture can generally consider these components:

Anycast DNS

Distributed service.

Multiple Authoritative Servers

Redundancy.

Secondary / Multi-Provider DNS

Reducing provider dependency.

DDoS Protection

High query capacity and mitigation.

RRL

Reducing reflection abuse.

Monitoring

Tracking QPS, latency and errors.

SOC Integration

Incident correlation.

All of these must be designed around the organisation's risk level.

What Is DNS Resilience?

DNS resilience is the DNS service's capacity to keep serving under attack, failure or provider problems.

It is not only DDoS protection.

It also includes the components of;

redundancy,

failover,

capacity,

monitoring,

recovery.

DNS resilience is therefore one of the important parts of cyber resilience.

What Should a DNS DDoS Report Contain?

A professional DNS resilience assessment can include these areas:

DNS Architecture

The authoritative and recursive structure.

Provider Analysis

The DNS services in use.

Traffic Baseline

Normal QPS and latency.

Attack Scenarios

The DDoS tests applied.

Capacity

Maximum sustainable QPS.

DNS Latency

Response time normally and under attack.

Error / Timeout Rate

Failed queries.

Mitigation Time

How long protection took to engage.

Redundancy Analysis

The state of anycast and secondary DNS.

Recommendations

Improvement recommendations.

How Should Management See DNS DDoS Risk?

From a management perspective the technical statement:

“A 500,000 QPS attack”

may not be meaningful on its own.

An output like this is far more valuable instead:

“The DNS infrastructure used by critical customer services remained available under queries 15 times normal traffic. But in the random subdomain scenario response latency rose to 1.8 seconds and a capacity risk was seen on the primary provider. A plan to engage secondary DNS was recommended.”

This output relates directly to business continuity.

DNS DDoS and Business Continuity

A DNS outage can create very broad business impact.

Because the same domain infrastructure can affect many services such as;

web,

API,

mail,

VPN,

the customer portal.

DNS outage and DNS DDoS must therefore be covered separately in BCP scenarios.

Conclusion: Even if Your Application Is Up, Your Service Can Go Down if DNS Fails

DNS is usually an infrastructure service users never notice.

Nobody thinks about it while it works.

When it stops working, almost every digital service is affected.

Seeing DNS merely as a technical network service is therefore wrong in DDoS security.

DNS is one of the fundamental dependencies of digital business continuity.

A DNS DDoS attack can target;

query capacity,

bandwidth,

cache systems,

authoritative servers.

DNS amplification, meanwhile, can abuse DNS infrastructure in attacks aimed at other targets.

Random subdomain and DNS water torture attacks reduce the cache advantage and strain the authoritative infrastructure.

A strong DNS defence must therefore be designed with the approach;

anycast + redundancy + multi-provider + DDoS protection + rate limiting + monitoring + SOC integration

working as a whole.

And it must be tested.

Because knowing that the DNS provider offers high capacity and verifying that your own domains remain available under a real attack are not the same thing.

But blocking a DNS attack technically is not enough on its own.

When a DDoS attack begins, the organisation's security team must be able to detect it accurately and quickly.

Is it an attack?

Is it genuine customer demand?

Which layer is being targeted?

Which service is affected?

Which mitigation should engage?

The answers to these questions are sought in the DDoS detection and security monitoring processes.

Next Topic

How Is a DDoS Attack Detected? SOC, SIEM, NDR and Traffic Analysis

What are the first signs of a DDoS attack?

How is a traffic baseline built?

How are Gbps, PPS, CPS, RPS and QPS anomalies interpreted?

How is a flash crowd distinguished from a real DDoS attack?

How do the SOC, SIEM, NDR, WAF and anti-DDoS see the same attack together?

In the next article we will examine the DDoS detection, traffic analysis, behavioural analytics, SOC monitoring and SIEM correlation processes in detail.