thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

DNS Amplification

A reflected DDoS attack that abuses open DNS resolvers to send large responses to a spoofed victim address.

Definition

The attacker sends DNS queries, often for large record sets or ANY, with the victim's spoofed source IP. Resolvers send amplified responses to the victim, saturating its bandwidth. Closing open resolvers, response rate limiting and ingress filtering mitigate it.

Example

Queries for a large TXT record via thousands of open resolvers flooding a target with responses.

Exam tip

Know that DNS uses UDP 53, enabling spoofing; it is a reflection plus amplification attack.

Related terms