What is a DNS Flood attack?
The DNS Flood is a DDoS attack that saturates DNS servers with a massive volume of queries, exhausting their ability to respond and making the domains they resolve unreachable. Since DNS is the phone book of the internet, taking it down means users can't find the site even if the web server is perfectly operational.
DNS Flood vs DNS Amplification
The DNS Flood attacks the DNS server directly with queries. DNS amplification, by contrast, uses open resolvers as reflectors: it sends small queries with the victim's spoofed IP and triggers much larger responses aimed at them. Both abuse UDP and its lack of source verification.
How to mitigate it?
Use anycast, high-capacity DNS providers, query rate limiting, anomalous-traffic filtering, close open resolvers, and deploy DNS-specialized anti-DDoS services that tell legitimate queries from the attack flood.
