DNS Issues

DNS Amplification Risk

DNS amplification is a type of DDoS attack where an attacker sends small DNS queries with a spoofed source IP to open recursive resolvers, which respond with much larger answers directed at the victim. Amplification factors can reach 50x or more, especially with DNSSEC-signed responses or ANY queries. If your DNS server is open to recursive queries from the internet, it can be weaponized in these attacks.

Symptoms

  • Abnormally high outbound DNS traffic from your server
  • Network abuse complaints from upstream providers
  • DNS server performance degradation during attack periods
  • Your IP appearing on DNS amplification attack blocklists

Common Causes

  • Open recursive resolver accessible from the internet
  • Authoritative server responding to ANY queries with large payloads
  • No rate limiting on DNS query responses
  • Missing BCP38/source address validation on network perimeter

Step-by-Step Troubleshooting

  1. 1

    Check for open recursion

    Test if your DNS server answers recursive queries from external sources.

    Use DNS Lookup →
  2. 2

    Scan DNS port

    Verify that port 53 is not unnecessarily exposed to the internet.

    Use Port Scanner →
  3. 3

    Check IP reputation

    See if your IP is already flagged in abuse databases.

    Use IP Analysis →
  4. 4

    Disable open recursion

    Restrict recursion to authorized client networks only.

  5. 5

    Implement response rate limiting

    Enable DNS RRL (Response Rate Limiting) to throttle identical responses to the same destination.

Recommended Diagnostic Tools

DNS LookupPort ScannerIP Analysis

Monitor DNS Traffic

Detect anomalous DNS query patterns and prevent amplification abuse.

Related Problems

Frequently Asked Questions