DNS Amplification

Abusing DNS services as a DDoS tactic

Introduction

DNS Amplification is a type of Distributed Denial-of-Service (DDoS) attack that abuses publicly accessible DNS servers to generate a large volume of traffic toward a victim.

The attack exploits the difference between the size of a relatively small DNS request and the much larger response it can produce.

In these attacks, the attacker sends DNS queries with the victim’s IP address as the spoofed source address.

On receipt of the query, the DNS servers then send their responses to the victim rather than to the attacker.

This creates the amplification effect which is exacerbated when many DNS servers are abused simultaneously – the resulting traffic can overwhelm the victim’s network connection, firewall, or servers.

Why does amplification occur?

DNS supports queries that can produce responses considerably larger than the original request.

For example, a small DNS query might request information associated with a domain as opposed to just the IP address data

The DNS responses can contain:

  • Multiple DNS records
  • TXT records
  • DNSSEC information
  • Additional authority information
  • Other associated DNS data

This creates an amplification factor.

The exact amplification factor varies depending on the DNS query, response, protocol behaviour and configuration.

Potential impact of DNS amplification attacks

  • Bandwidth Exhaustion – The volume of traffic can consume the victim’s available Internet bandwidth.
  • Service Disruption – Websites, APIs and other Internet-facing services may become inaccessible.
  • Infrastructure Overload – Firewalls, routers, load balancers and other network devices may become overwhelmed.
  • Increased Operational Costs – Organisations may experience increased network and cloud infrastructure costs.
  • Collateral Damage – Large attacks can affect upstream providers, neighbouring infrastructure or shared network resources.
  • Reputational Damage – Extended outages can affect customer confidence and business operations.

Detection indicators

Security teams should monitor for:

  • Sudden increases in inbound UDP traffic
  • Large volumes of DNS responses without corresponding outbound queries
  • DNS responses arriving from many unrelated IP addresses
  • Large numbers of DNS responses directed toward a single destination
  • Unexpected increases in network bandwidth consumption
  • UDP/53 traffic arriving from unexpected sources
  • Unusual packet-size distributions
  • Sudden changes in normal network traffic patterns
  • Network devices approaching bandwidth or connection limits

A particularly important indicator is an asymmetry between outbound DNS requests and inbound DNS responses – A host receiving thousands of DNS responses despite not generating corresponding queries should be investigated.

Prevention and Defence

  • Prevent IP Address Spoofing – Network providers should implement source-address validation to prevent attackers from sending packets containing forged source addresses.
  • Secure DNS Resolvers – DNS resolvers should not be unnecessarily exposed as unrestricted open resolvers.
  • Rate Limiting – DNS infrastructure can implement response and query rate controls to limit abuse.
  • Network Monitoring – Monitor DNS traffic and establish baselines for normal DNS activity.
  • DDoS Protection – Use upstream DDoS mitigation services capable of absorbing or filtering large volumes of unwanted traffic.
  • Network Segmentation – Separate critical services and restrict unnecessary exposure of infrastructure.
  • Incident Response – Maintain procedures for rapidly identifying the attack source, contacting upstream providers and activating DDoS mitigation.

Conclusion

DNS Amplification abuses legitimate DNS infrastructure to magnify traffic toward a victim.

The attack relies on two important concepts:

  • Source IP spoofing – The attacker makes DNS servers believe that the victim originated the request.
  • Response amplification – The DNS response can be significantly larger than the original request.

Defending against DNS amplification therefore requires protection at multiple levels

Source-address validation + secure DNS configuration + rate limiting + network monitoring + DDoS mitigation

DNS itself is not inherently malicious – the attack occurs when poorly controlled or exposed DNS infrastructure is abused as a traffic amplification mechanism.