Topic starter
23/06/2026 7:14 pm
TL;DR: DNS amplification attacks exploit open or misconfigured DNS resolvers to multiply small spoofed queries into traffic floods that can exceed the original request by 50x or more, according to DigiCert. The practical lesson is that availability depends on resolver hygiene, source-address filtering, and response controls, not just edge capacity.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “What is a DNS Amplification Attack?”.
By the numbers:
- DNS amplification attacks can multiply attack traffic by 50x or more.
Key questions
Q: What breaks when DNS resolvers are open to recursion from any source?
A: Open recursion turns your DNS infrastructure into a reflection tool that can be abused by attackers to amplify traffic toward a victim.
Q: Why do DNS amplification attacks cause such severe availability risk?
A: They create a multiplier effect.
Q: How can security teams tell whether DNS amplification is happening in real time?
A: Look for unusual spikes in UDP port 53 traffic, high volumes of responses that do not match legitimate query patterns, and repeated resolver replies from sources that should not be serving that workload.
Practitioner guidance
- Disable open recursion on authoritative resolvers Restrict recursive answers to trusted clients only, and verify that authoritative servers do not answer arbitrary external requests.
- Enforce response rate limiting on high-risk DNS services Configure response rate limiting where the resolver software supports it, then tune thresholds so legitimate bursts are not suppressed.
- Apply source-address filtering at network boundaries Work with upstream providers to implement ingress and egress filtering that blocks spoofed packets from entering or leaving your environment.
Bottom line: DNS amplification remains a practical outage path because open or misconfigured resolvers can magnify tiny spoofed queries into much larger floods.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:09 am
Open recursion is an exposure control problem, not just a DNS setting. A resolver that answers arbitrary external queries becomes reusable attack infrastructure the moment spoofed requests can reach it. That is why resolver governance belongs in the same conversation as service exposure, access scope, and network trust boundaries. Practitioners should stop treating recursive behaviour as harmless convenience and treat it as a controlled entitlement.
A question worth separating out:
Q: Should organisations prioritise resolver hardening or DDoS scrubbing first?
A: Resolver hardening should come first because it reduces the amount of attack traffic that can be generated in the first place. DDoS scrubbing is still valuable, but it is a compensating control. The strongest posture combines both, with source filtering and response limits preventing abuse upstream of mitigation.
👉 Read our full editorial: DNS amplification attacks expose the limits of open resolver control