How DNS UDP Amplification Attacks Work

A DNS UDP amplification attack is a form of Distributed Denial of Service (DDoS) where an attacker weaponizes publicly accessible Domain Name System (DNS) servers to flood a target network with overwhelming traffic. By taking advantage of the connectionless nature of the User Datagram Protocol (UDP) and the disproportionate size ratio between DNS requests and responses, attackers can multiply their traffic volume dozens of times over. This article explains the underlying mechanics of DNS amplification, how IP spoofing makes it possible, the role of open resolvers, and how organizations defend against these attacks.

The Role of UDP and IP Spoofing

DNS predominantly uses UDP for standard queries because it does not require a formal handshake to establish a connection, unlike TCP. This design prioritizes speed but lacks built-in source validation.

Attackers exploit this lack of validation by forging (spoofing) the source IP address in the UDP packet header. Instead of listing their own IP address, the attacker inserts the victim’s IP address. When the DNS server processes the query, it sends the response back to the spoofed address—the victim—rather than the actual sender.

Open DNS Resolvers

An open DNS resolver is a DNS server configured to accept recursive queries from any IP address on the internet. While authoritative DNS servers are meant to answer queries only for the specific domains they host, open resolvers will look up any domain for any requester. Attackers scan the internet to locate thousands of misconfigured open resolvers to act as unwitting reflectors in their attack.

The Amplification Factor

The primary danger of a DNS amplification attack lies in the size difference between the query sent by the attacker and the response sent to the victim.

  1. Small Queries: An attacker sends a tiny request (typically 60 to 100 bytes).
  2. Large Responses: The request asks for large resource records, such as ANY or TXT records, or utilizes Extension Mechanisms for DNS (EDNS0), which allows DNS responses to exceed the traditional 512-byte limit.
  3. Multiplier Effect: A carefully crafted query can generate a response of 3,000 to 4,000 bytes or more. This yields an amplification factor of 50x to 70x the original data sent by the attacker.

Step-by-Step Execution

  1. Target Selection and Request Forgery: The attacker determines the victim’s IP address and crafts millions of small UDP DNS requests with the victim’s IP set as the source.
  2. Botnet Distribution: The attacker uses a botnet (a network of compromised computers) to send these spoofed requests simultaneously to thousands of open DNS resolvers.
  3. Response Generation: The open resolvers process the requests and generate maximum-payload DNS responses containing extensive record data.
  4. Target Flooding: The resolvers direct all amplified responses directly to the victim’s IP address.
  5. Denial of Service: The massive volume of incoming traffic saturates the victim’s network bandwidth and exhausts server processing resources, rendering the target inaccessible to legitimate users.

Mitigation Strategies

Defending against DNS amplification requires action from both network operators and individual organizations: