DNS Amplification Attack

A DNS amplification attack works by sending a small query with a spoofed source IP (your victim) to an open resolver. The resolver then sends a much larger response to the victim, multiplying the traffic. Attackers chain this across many open resolvers to generate massive volumetric floods.

If you run a public DNS server or sit behind one, the two defenses below are worth putting in place.

Block ANY Queries with iptables

The ANY query type (opcode 0x0000FF0001 in the hex pattern) is the most common amplification vector. These two iptables rules track hosts that send ANY queries and drop them after three hits within ten seconds.

iptables -v -I INPUT 1 -p udp --dport 53 -m string --from 50 --algo bm --hex-string '|0000FF0001|' -m recent --set --name dnsanyquery
iptables -v -I INPUT 2 -p udp --dport 53 -m string --from 50 --algo bm --hex-string '|0000FF0001|' -m recent --name dnsanyquery --rcheck --seconds 10 --hitcount 3 -j DROP

The first rule tags the source address. The second checks the tag and drops the packet once the threshold is exceeded.

Harden BIND

If you are running BIND as a recursive resolver, lock down the configuration so it cannot be abused as an amplification source. Add the following directives to your named.conf (or the relevant zone file):

allow-transfer { "none"; };
allow-recursion { "none"; };
recursion no;
additional-from-auth no;
additional-from-cache no;

Quick Checklist

• Confirm your resolver is not listed on public open-resolver scans.
• Apply the iptables rules above on any host that accepts UDP/53 traffic.
• Review BIND logs (/var/log/named/) for spikes in ANY or large TXT queries.
• If you do not need a public resolver, restrict allow-recursion to your internal subnet only.

These steps will not stop every variant of a DNS-based DDoS, but they close the most common amplification path and give you a measurable reduction in attack volume.

• Security
• Networking

• Dns
• SysAdmin
• Bash