What makes DNS a common vector for amplification attacks?

A small DNS query can trigger a much larger response — especially an ANY query or one returning DNSSEC-signed records — so an attacker's limited bandwidth gets multiplied many times over by the time it reaches the victim.

Does having DNSSEC enabled make amplification attacks worse?

DNSSEC-signed responses are larger than unsigned ones, which can increase the amplification factor for a given query — but this is a reason to run rate limiting and disable open recursion, not a reason to avoid DNSSEC, which defends against a completely different attack (spoofing).

What's the single most effective fix for open-resolver abuse?

Restricting a resolver to only answer queries from its own legitimate client base, rather than the entire internet, removes it as a usable reflector — combined with BCP38 filtering at network edges to stop spoofed source addresses from being sent in the first place.

DNS Amplification DDoS: How It Works and How It's Mitigated

DNS amplification doesn't attack DNS itself — it uses DNS as an unwitting megaphone, pointed at whoever the attacker chooses.

What DNS Amplification Is

In a reflection attack, an attacker sends a query to an open DNS resolver with the source address spoofed to the victim's IP. The resolver, following the protocol correctly, sends its response to that spoofed address — the victim — rather than to the attacker.

Why DNS Specifically

A small query — an ANY query, or one that triggers a DNSSEC-signed response — can produce a reply many times larger than the request that caused it. That multiplication means the attacker's own bandwidth is amplified by that factor at the victim's expense, which is exactly why DNS, alongside NTP and memcached historically, is a favorite reflection vector.

The Role of Open Resolvers

An open resolver answers recursive queries from anyone on the internet, not just clients on its own network. A resolver restricted to its own address space can't be abused as a reflector this way, since spoofed traffic claiming to be an arbitrary victim was never going to reach it from outside in the first place.

Standard Mitigations

Response Rate Limiting (RRL) on authoritative servers, which throttles repeated identical responses sent toward the same apparent source
Disabling open recursion on any resolver not specifically meant to serve the public internet
BCP38 source-address filtering at the network edge, which stops spoofed-source packets from leaving a network at all — addressing the root cause rather than a downstream symptom

How PixDNS Fits In

PixDNS's own lookups query a fixed, small whitelist of major public resolvers on the user's behalf — it doesn't run an open recursive resolver of its own that arbitrary internet traffic could query or abuse as a reflector.

Look Up a Domain's DNS

Run a DNS lookup →Next: Subdomain takeover →

Try it on your domain

See the theory in practice — run a DNS Lookup for your own domain.