DNS amplification is a reflection attack: the attacker spoofs the victim's IP and sends small DNS queries to open resolvers. The resolver sends a large DNS response — sometimes 70x larger — directly to the victim. Multiply this across 100,000 open resolvers and you have a terabit-scale attack.
The Amplification Math
Attack arithmetic
A 40-byte DNS query for a large DNSSEC-signed zone can produce a 4,096-byte response — a 100x amplification factor. With 50,000 open resolvers sending simultaneously, a 1Gbps attacker generates 100Gbps of inbound traffic at the victim.
Why Open Resolvers Still Exist
- Misconfigured home routers and ISP equipment.
- Legacy DNS servers left open for 'convenience'.
- Cloud instances launched without firewall rules.
- Estimated 5+ million open resolvers still reachable as of 2025.
What the Target Sees
All traffic appears to come from legitimate DNS servers — IPs that are impossible to globally blacklist. Standard rate-limiting and IP blocklists fail. Only a scrubbing proxy that can distinguish legitimate DNS responses from reflection traffic can stop the attack effectively.
Where Akarguard Helps — and Where It Doesn't
- DNS amplification is a network-layer (L3/L4) flood; the raw UDP/53 traffic has to be dropped upstream, at your host or transit provider's network — not by an HTTP reverse proxy.
- Ask your provider whether they perform BCP38 source-address validation and can filter reflected UDP at the edge of their network.
- Behind Akarguard your origin IP is hidden, so a flood aimed at your server has no direct target.
- Akarguard filters the application-layer (L7) attacks that reach your site; it is not a volumetric UDP scrubber and does not claim to be.