What is a DNS amplification attack?

A DNS amplification attack is a type of DDoS attack where an attacker sends small DNS queries with a spoofed source IP (the victim's IP) to many open DNS resolvers. Each resolver sends a much larger response to the victim, amplifying the attacker's bandwidth by 28-54x. The result is that a small attack traffic volume generates a massive flood directed at the target.

How big is the amplification factor in DNS?

The typical amplification factor for DNS is 28 to 54 times. A single 60-byte DNS query for ANY record can produce a response of 3,000-4,000 bytes. The largest amplification comes from ANY queries to domains with large DNSSEC records, which can reach amplification factors of 54x.

How do I protect my network from DNS amplification attacks?

Protect yourself by: using a DNS resolver that blocks open recursion (only serves your own network), enabling response rate limiting (RRL), filtering outbound DNS traffic to prevent your network from being used as an amplifier, using BCP38 (source address validation) to prevent IP spoofing, and deploying DDoS protection services like Cloudflare or Akamai.

Why do DNS amplification attacks use the ANY query?

The ANY query type asks for all record types (A, AAAA, MX, TXT, SOA, NS, DNSKEY, etc.) for a domain. The combined response is much larger than any single record type, maximizing the amplification factor. Many modern DNS providers now rate-limit or refuse ANY queries to mitigate this.

DNS Amplification & DDoS Attacks Explained — How They Work & Defense

DNS amplification is one of the most common and destructive DDoS attack techniques on the internet. It exploits the fact that a small DNS query can produce a response 28 to 54 times larger, and that DNS queries can be sent with a spoofed source IP address. By directing these oversized responses at a target, an attacker can generate gigabits of attack traffic from a modest network connection.

This guide explains the mechanics of DNS amplification and reflection attacks, how large the amplification factor really is, and the practical steps network administrators and individuals can take to defend against them.

How DNS Amplification Attacks Work

The attack works in three steps, and understanding each step reveals why DNS is such an effective amplification vector.

Step 1 — Spoofed query

The attacker sends a small DNS query (typically 40-60 bytes) to a large number of open DNS resolvers on the internet. Critically, the attacker spoofs the source IP address in the UDP header, replacing their own IP with the victim's IP address. Because UDP is connectionless, there is no handshake — the resolver happily sends its response to the spoofed address.

Step 2 — Amplification

The DNS resolver processes the query and sends the response to the victim. If the query asks for ALL record types (ANY), or for a domain with large DNSSEC records, the response can be 3,000 to 4,000 bytes — a 50-70x amplification over the 60-byte query. Even a normal A record query produces a response roughly 28-40x larger than the query.

Step 3 — Volumetric flood

By sending millions of these queries from thousands of open resolvers, the attacker generates a massive flood of DNS traffic aimed at the victim's infrastructure. A 1 Gbps network connection sending spoofed queries can generate 50-100 Gbps of attack traffic directed at the target. Most servers and networks cannot absorb that volume without DDoS protection.

The attack is particularly effective because the responses are valid DNS traffic — they look legitimate to network equipment and are difficult to filter without DNS-aware security tools.

DNS Amplification Factors by Record Type

Not all DNS records produce the same amplification. The amplification factor depends on the query type and the size of the DNSSEC records involved.

A record query: Amplification factor of approximately 28x. A 40-byte query for a simple A record produces a response of about 1,100 bytes.

AAAA record query: Amplification factor of approximately 30x. Slightly larger responses due to the 128-bit IPv6 addresses.

ANY record query: Amplification factor of 40-54x. The ANY query returns all record types for the domain in a single response. A domain with A, AAAA, MX, TXT, SOA, NS, and DNSKEY records produces a combined response of 3,000 to 4,000 bytes. This is the most commonly abused query type.

DNSKEY record query: Amplification factor of 50-70x. DNSSEC key records are large and produce the largest amplification factors in the DNS protocol. A single DNSKEY response can be 2,000 to 3,000 bytes.

To reduce DNS amplification, many DNS providers now refuse or rate-limit ANY queries. This is an effective mitigation — without the ANY query type, the maximum amplification factor drops from 54x to about 28x, significantly reducing attack effectiveness.

Real-World DNS Amplification Attacks

DNS amplification has been used in some of the largest DDoS attacks ever recorded:

2013 Spamhaus attack: One of the first high-profile DNS amplification attacks reached 300 Gbps and was directed at anti-spam organization Spamhaus. The attack used approximately 30,000 open DNS resolvers and was the largest DDoS attack recorded at the time.

2016 Dyn attack: The attack on DNS provider Dyn disrupted major websites including Twitter, Netflix, Reddit, and GitHub. While primarily a botnet-based attack (Mirai), DNS amplification was also used as part of the multi-vector assault that reached hundreds of Gbps.

2020 AWS 2.3 Tbps attack: Amazon Web Services mitigated a 2.3 Tbps UDP amplification attack — the largest recorded at the time. The attack used a combination of DNS and other UDP-based amplification vectors and peaked at 2.3 million packets per second.

These attacks demonstrate that DNS amplification is not theoretical — it is an active and growing threat to internet infrastructure.

How to Defend Against DNS Amplification Attacks

Defense requires action at three levels: preventing your network from being used as an amplifier, protecting your infrastructure from incoming amplified traffic, and working with your ISP.

Prevent your network from being an amplifier

Close open resolvers. If you run a recursive DNS resolver, restrict it to serve only your own network. Configure it to reject queries from external IP addresses. An open resolver is an amplifier waiting to be exploited.

Implement BCP38 / source address validation. Configure your network equipment to reject outbound packets with spoofed source IPs. If a packet leaves your network, its source IP must belong to your address space. This is the most fundamental defense against all spoofing-based attacks and is a BCP38 requirement for ISPs.

Rate-limit ANY queries. If you operate an authoritative DNS server, rate-limit or refuse ANY queries. This reduces your server's amplification potential and protects the internet at large.

Protect against incoming attacks

Deploy DDoS protection. Services like Cloudflare, Akamai, AWS Shield, and Google Cloud Armor can absorb and filter large volumes of DDoS traffic. These services operate at the edge of their massive networks and can filter DNS amplification traffic before it reaches your infrastructure.

Enable response rate limiting (RRL). If you run authoritative nameservers, enable RRL to cap the number of identical responses sent in a given time window. This limits the effectiveness of using your server as an amplification source.

Use anycast routing. Distributing DNS across multiple geographic locations via anycast spreads the attack surface. A DDoS that overwhelms one location is absorbed by others. Major public DNS providers like Cloudflare and Google use anycast specifically for this reason.

How to Detect a DNS Amplification Attack

If you are under a DNS amplification attack, you will see a sudden, massive spike in inbound UDP traffic on port 53. The traffic originates from many different source IPs (the open resolvers being used) and targets your IP addresses.

Signs of an active attack include: network latency spikes, packet loss on your primary connection, firewall logs showing thousands of UDP/53 packets per second, and your ISP contacting you about traffic anomalies.

You can check whether your network is being used as an amplifier by monitoring outbound DNS traffic. A sudden spike in outbound UDP/53 traffic to unfamiliar domains is a strong indicator that your resolver is being exploited in an amplification attack. Use DNS monitoring to watch for this.

If you are a website operator and suspect your infrastructure is targeted, check with your hosting provider. Most major cloud providers (Cloudflare, AWS, GCP) have DDoS dashboards that show attack traffic in real time.