Cybersecurity glossary
What is a DNS Amplification Attack?
Learn how DNS amplification attacks abuse open resolvers and large responses to flood victims, why ANY/TXT queries amplify traffic, and which defenses reduce risk.
Definition
A DNS amplification attack is a reflected denial-of-service technique in which attackers send small spoofed DNS queries to servers that return much larger responses to a victim’s IP address, multiplying attack bandwidth.
Why DNS amplification is effective
DNS mostly answers over UDP without a handshake. If a server will respond to anyone, an attacker can spoof the victim’s address and trigger replies that are many times larger than the query. That asymmetry is the core of a DNS amplification attack.
The attacker’s uplink can stay small while the victim absorbs a flood of unwanted DNS responses from many reflectors.
How the attack unfolds
Find amplifiers
Scan for open resolvers or other DNS servers that answer strangers with large payloads.
Craft a small query
Choose a question known to produce a bulky answer, historically including broad query types or large records.
Spoof the source IP
Send UDP queries that claim to originate from the victim’s address.
Reflect and amplify
Servers send large responses to the victim, multiplying bandwidth.
Distribute the sources
Many reflectors make filtering by single IP ineffective.
Exhaust victim capacity
Links, firewalls, or DNS infrastructure choke under the reflected flood.
Why amplification ratios get large
Tiny questions
Query packets can be only tens of bytes while answers reach thousands.
Bulky answers
Large TXT/DNSSEC-related material or wide responses increase the multiplier.
Open recursion
Resolvers willing to recurse for the world are high-value reflectors.
UDP without handshake
No reverse proof that the claimed source IP requested the answer.
Defenses by role
| Role | Primary controls |
|---|---|
| Access network operators | Ingress/egress anti-spoofing (BCP 38/84), block forged sources leaving customers |
| Resolver operators | Disable open recursion, authenticate clients, rate-limit, response size controls |
| Authoritative operators | Avoid unnecessary huge answers to strangers, monitor abuse, anycast capacity |
| Potential victims | Upstream scrubbing, anycast, ACLs, capacity planning, incident playbooks |
Mitigation checklist
- Ensure your recursive DNS is not an open amplifier on the public Internet.
- Apply source-address validation on customer and peering edges where you can.
- Rate-limit identical queries and oversized responses from recursive services.
- Keep authoritative zones free of needlessly enormous public records when possible.
- Monitor for sudden outbound DNS response spikes that indicate reflection abuse.
- Pre-arrange DDoS mitigation with upstreams before a large event hits.
- Segment critical management planes so DNS floods cannot strand operators.
- Participate in notification channels when your IPs are reported as reflectors.
The practical takeaway
A DNS amplification attack turns compliant DNS servers into unwilling loudspeakers: small spoofed queries produce large responses aimed at a victim. The protocol’s UDP convenience becomes a force multiplier for DDoS.
Close open resolvers, stop spoofed packets at the edge, and plan capacity for reflected floods. Amplification is less a clever exploit than a failure of Internet hygiene at scale.
Related security terms
DNS Resolver
Resolvers—especially open ones—are frequent amplifiers in these attacks.
EDNS
Extension mechanisms that can allow larger DNS payloads over UDP.
Anycast DNS
Distributed DNS deployments used both by defenders and large public resolvers.
TXT Record
Large TXT answers are sometimes abused as amplification material.
Domain Name System (DNS)
The protocol surface that reflection attacks misuse.
Frequently asked questions
What is a DNS amplification attack in simple terms?
Attackers ask DNS servers a small question while pretending to be the victim. The servers send big answers to the victim, flooding their network.
Why does DNS amplify traffic?
A tiny UDP query can trigger a much larger response, especially for broad queries or records with bulky data, creating a high amplification ratio.
What is source address spoofing’s role?
The attacker forges the query’s source IP as the victim’s address so responses are delivered to the victim instead of the attacker.
Are only open resolvers abused?
Open resolvers are common amplifiers, but misconfigured authoritative servers and other UDP services can also be leveraged.
Does switching DNS to TCP stop amplification?
Forcing TCP reduces classic UDP reflection, but deployment is incomplete and attackers may shift techniques. Network anti-spoofing remains essential.
How can network operators help?
Apply BCP 38/84 anti-spoofing, close open resolvers, rate-limit responses, and participate in coordinated DDoS response.
Can victims filter all DNS floods easily?
Not always. Responses may look like legitimate DNS from many sources. Capacity, scrubbing, anycast, and upstream filtering are often required.
References
Explore authoritative guidance and frameworks related to dns amplification attack.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.